When should organisations choose ISO 27001:2022 over an older version of the standard?

Why ISO 27001:2022 Is the Better Baseline for New and Renewing Programmes

For a new certification effort, the 2022 edition is the cleaner starting point because it matches current audit expectations and reduces the need to design around controls that are already being retired. For an existing ISMS, moving early also helps you avoid duplicate work later, especially where the standard now places more emphasis on cloud, supplier, identity, and resilience topics.

That alignment matters most when organisations are building the ISMS from scratch or re-scoping an existing one. The practical question is not whether older editions are “wrong”, but whether they create avoidable gap work, evidence churn, or control rationalisation later in the audit cycle. ISO/IEC 27001:2022 Information Security Management is the current reference point for that decision.

When teams delay the update, they often end up maintaining two mental models at once: one for the legacy control set and one for the current edition. That is rarely efficient in a live ISMS, especially when certification scope, risk treatment decisions, and control ownership all need to line up under one version.

What Actually Changes for Practitioners Between Versions

The most important change is not just the number of controls, but the shape of the control set. The 2022 edition is easier to map to modern operating realities such as remote work, managed services, cloud adoption, supplier dependency, and tighter access governance. For that reason, it usually fits better when organisations need the standard to support day-to-day security operations rather than a paper-only certification exercise. ISO/IEC 27002:2022 Information Security Controls is the companion reference for implementing those controls in practice.

If the organisation already has an ISMS built on the older version, the main issue is control mapping. You need to decide whether each legacy control still has an equivalent, whether the evidence remains sufficient, and whether any shared controls need to be reworded, merged, or split to fit the newer structure. That is where a clean transition plan saves time.

For most teams, the update is also a governance decision. A current edition gives auditors, internal reviewers, and control owners the same language for scope, risk assessment, policy structure, internal audit, and Statement of Applicability decisions. That makes it easier to keep the ISMS coherent as it expands.

When It Makes Sense to Stay on the Older Edition Temporarily

There are still valid reasons to remain on an older edition for a short transition window, but those reasons are tactical rather than strategic. If a certification cycle is already in motion, if contractual deadlines are tied to the existing scope, or if the organisation is constrained by resource availability, the older version may remain workable until the transition is complete.

The key is to treat that as a controlled exception, not a long-term plan. Older editions become progressively more expensive to support because every new policy, control review, or evidence pack has to be interpreted through a standard that is no longer the current target state. That can be manageable for a short period, but it becomes inefficient when the ISMS is still evolving. ISO 27002 Controls Guide is useful when you need to translate the 2022 control structure into implementation detail.

That is why the real decision is usually about timing, not principle. If the organisation can transition without disrupting certification milestones or major change programmes, moving sooner is usually the lower-friction option.

Risk and Threat Considerations

Staying on an older version for too long can create control drift, where the ISMS no longer reflects current attack patterns or technology use. The practical risk is not theoretical non-compliance alone, but a weaker control model around cloud services, supplier dependencies, identity management, and recovery readiness.

Failure mechanism: Legacy control language can leave gaps in ownership, evidence, and operational enforcement, especially when new systems are introduced after the ISMS was first defined. That makes it easier for misaligned controls to survive audits while still underperforming in practice.

Impact: Organisations may approve an ISMS that looks current on paper but does not fully cover the environment they actually run, which raises audit rework, remediation cost, and exposure to avoidable security weaknesses.

Practitioner Guidance

What to prioritise: Decide whether the organisation is in a certification, renewal, or change programme, then align the standard version to that timeline first. If the next major ISMS review is already planned, it is usually better to update the version during that cycle than to defer and remap everything later.

What to verify: Check whether your scope statement, risk treatment plan, Statement of Applicability, and internal audit plan are all using the same edition. If those artefacts diverge, the transition is already creating governance noise and should be consolidated before the next external audit.

Practitioner takeaway: Choose the newer edition when you want the ISMS to stay aligned with current operating reality, not merely to satisfy a historical certification checkpoint.

Related resources from NHI Mgmt Group

• Guide: ISO 27001 Certification Guide
• When should organisations prioritise ISO 27001:2022 over finishing a certification effort on ISO 27001:2013?
• How should security teams govern non-human identities for ISO 27001?
• Should organisations choose NIST CSF or ISO 27001 for NHI governance first?
• How should organisations prepare for ISO 27001:2022 certification if they rely on cloud access and admin credentials?