How Many Total Controls Are Included in ISO 27001:2022?

Date September 5, 2025
Category
ISO 27001
How Many Total Controls Are Included in ISO 27001:2022?

If you are preparing for ISO 27001 certification, one of the most common questions you might ask is: “How many controls are in ISO 27001:2022?”

The simple answer is: ISO 27001:2022 includes 93 controls in Annex A.

But to truly understand the update, it’s important to compare it with the previous version, ISO 27001:2013, and see how the controls have been restructured, reduced, and modernized to reflect today’s security landscape.

At ISO27001PRO.com, we provide ISO 27001 templates, policies, and toolkits that are already aligned with the 2022 version, helping businesses transition smoothly.

ISO 27001:2013 – The Previous Control Set

In ISO 27001:2013, there were 114 controls, grouped into 14 domains. These domains included areas like Access Control, Cryptography, Human Resources Security, Supplier Relationships, and Information Security Policies.

While effective, some of the controls were overlapping, outdated, or repetitive. With the fast evolution of cloud services, remote work, and digital transformation, a more streamlined and updated approach became necessary.

ISO 27001:2022 – The Updated Control Set

The 2022 revision reduced the total number of controls to 93. However, this does not mean the standard became weaker—on the contrary, it became clearer, more modern, and better structured.

Instead of 14 domains, the controls are now grouped into 4 main categories:

This restructuring makes it easier for organizations to align security practices with their real-world operations.

Newly Added Controls in ISO 27001:2022

ISO 27001:2022 also introduces 11 new controls that address modern cybersecurity and privacy challenges. These include:

  • Threat Intelligence – Gathering and using information about potential cyber threats.
  • Information Security for Cloud Services – Ensuring cloud environments are properly protected.
  • ICT Readiness for Business Continuity – Making sure IT systems can support resilience and recovery.
  • Physical Security Monitoring – Monitoring premises with modern security tools.
  • Configuration Management – Managing and controlling IT configurations to avoid vulnerabilities.
  • Information Deletion – Secure removal of data when it’s no longer needed.
  • Data Masking – Protecting sensitive information during processing and sharing.
  • Data Leakage Prevention – Preventing unauthorized transfer of information.
  • Monitoring Activities – Enhancing system and user monitoring.
  • Web Filtering – Protecting against malicious or inappropriate websites.
  • Secure Coding – Ensuring applications are built with security from the ground up.

These new controls reflect today’s cloud-first, data-driven, and security-conscious business world.

Comparing ISO 27001:2013 vs ISO 27001:2022

To summarize the differences:

  • 2013 Version: 114 controls, 14 domains
  • 2022 Version: 93 controls, 4 categories, with 11 new controls added and several merged for simplicity

So while the number of controls decreased, the scope and relevance improved. The updated structure is more intuitive and closely aligned with modern risk environments.

Why This Matters for Your Business

If your organization was certified under ISO 27001:2013, you will need to transition to ISO 27001:2022 within the required timeframe. This means reviewing your policies, risk assessments, and Statement of Applicability to align with the new control structure.

At ISO27001PRO.com, we make this transition easier with ISO 27001:2022-ready templates and toolkits. Instead of re-writing your documentation from scratch, you can use our professionally designed resources that are already mapped to the new standard.

Final Thoughts

ISO 27001:2022 includes 93 controls, compared to the 114 controls in ISO 27001:2013. But the real change is not the number—it’s the modernization of controls, the simplified structure, and the addition of new requirements that reflect today’s cybersecurity challenges.

If you want to save time, reduce errors, and speed up your compliance journey, explore our complete range of ISO 27001:2022 templates, policies, and toolkits at ISO27001PRO.com. With the right resources, your transition to ISO 27001:2022 can be smooth, efficient, and fully audit-ready.