Preparing for ISO 27001:2023 — A Practical Guide

ISO 27001:2023 reorganizes Annex A into four themes: Organizational, People, Physical, Technological. The structure is cleaner. The work to adapt is real.

What actually changed

• The control set drops from 114 to 93 — through merging, not removal.
• Eleven new controls cover threat intelligence, cloud services, ICT readiness, and secure coding.
• The thematic grouping changes how you map and report, even when the underlying control is unchanged.

A practical migration path

Map your existing 2013 control language to the 2022/2023 themes first. Most teams discover 80% of the work is re-tagging, not re-implementing. Tackle the eleven new controls in a second pass — they are the genuine net-new effort.