ISO 27001:2022 recertification: a structured migration and renewal guide

Who owns this decision

ISMS officer as owner, CISO as approver, IT-Ops, Data Protection Officer, Legal and business units as contributors.

Key criteria to weight

• Gap analysis against the 11 new controls

  Threat Intelligence, Cloud, DLP, Monitoring, Secure Coding etc. Per control: present, partial, missing — that is the work list.

• Statement of Applicability (SoA)

  Each of the 93 controls in the 2022 version needs a documented applicability decision with rationale.

• Risk treatment plan

  Re-map risks against the new control structure, name actions, owners and dates.

• Demonstrable effectiveness

  The audit checks effectiveness, not documents. Plan evidence chains per control before the auditor arrives.

• Integration with NIS2 / DORA / AI Act

  The management-system structure (Clauses 4 to 10) becomes the carrier structure for other regulations. Avoid double work.

• Audit cycle and deadlines

  Recertification every 3 years, surveillance audits annually. Plan so that gap closure is visible before the surveillance audit.

Step-by-step decision flow

1. 1

   Delta-mapping 2013 → 2022

   Re-map existing control evidence onto the 2022 structure. What stays, what is consolidated, what is new.

2. 2

   Gap analysis against the 11 new controls

   Per new control: is the topic technically implemented? Is it documented as a process? Is there a policy? Is there evidence from the past year?

3. 3

   Update SoA and risk treatment

   Walk through 93 controls, justify applicability, document deviations. Move the risk-treatment plan onto the 2022 structure.

4. 4

   Update policies and procedures

   Information-security policy, cloud policy, threat-intelligence process, DLP policy, monitoring concept, configuration management.

5. 5

   Internal audit and corrective actions

   Run the internal audit with a fresh 2022 checklist. Treat findings as corrective cases, not as an open issues list.

6. 6

   Prepare for the recertification audit

   Anticipate auditor questions, structure the evidence folder, brief interview partners. The audit is a moderated presentation, not a blind check.

Compliance note

ISO 27001:2022 is the foundation for evidence under NIS2 Art. 21, DORA Art. 6 ff. and the AI Act (Art. 9 risk management). A clean migration to 2022 substantially reduces the effort for the other regulations. The new controls on Cloud (A.5.23), Threat Intelligence (A.5.7) and Monitoring (A.8.16) directly mirror NIS2 requirements.

Common pitfalls

• !Treating the 11 new controls as a documentation exercise instead of a real implementation.
• !Keeping SoA justifications generic — auditors ask specifically.
• !Not switching the risk-treatment plan to the 2022 control structure.
• !Running the internal audit with a 2013 checklist and being caught in the external audit.
• !Treating Threat Intelligence and Monitoring as a tool purchase instead of a process decision.

FAQ