ISO 27001:2022 — The Four Themes of Annex A

The 2022 revision consolidated the Annex A control set from 114 into 93 controls, grouped into four themes: Organizational (37), People (8), Physical (14) and Technological (34).

Eleven controls are entirely new, including threat intelligence, cloud services, ICT readiness for business continuity, and secure coding.

The SoA remains the anchor artefact — every included and excluded control must be justified. Auditors now expect explicit references to the new controls even where they are excluded.