Moving from the 2013 to the 2022 version without starting over

The 2022 version of ISO 27001 reorganizes Annex A: 93 controls instead of 114, grouped into 4 themes (organizational, people, physical, technological). 11 controls are entirely new.

The 11 new controls

• A.5.7 Threat intelligence
• A.5.23 Information security for use of cloud services
• A.5.30 ICT readiness for business continuity
• A.7.4 Physical security monitoring
• A.8.9 Configuration management
• A.8.10 Information deletion
• A.8.11 Data masking
• A.8.12 Data leakage prevention (DLP)
• A.8.16 Monitoring activities
• A.8.23 Web filtering
• A.8.28 Secure coding

90-day plan

• Day 1-30: Automatic 2013 → 2022 mapping (BeeLink does this in 5 seconds)
• Day 31-60: Closing the gaps on the 11 new controls
• Day 61-90: Updating the Statement of Applicability (SoA) and internal audit