--- title: ISO 27001:2022 Requirements Explained for 2025 | daily.dev description: Organizations must migrate from ISO 27001:2013 to ISO 27001:2022 by October 31, 2025, or risk losing certification. The guide walks through the standard's... canonical: https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ISO 27001:2022 Requirements Explained for 2025 | daily.dev og:description: Organizations must migrate from ISO 27001:2013 to ISO 27001:2022 by October 31, 2025, or risk losing certification. The guide walks through the standard's... og:url: https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx og:image: https://api.daily.dev/og/posts/wZzEPzirX.png og:image:alt: ISO 27001:2022 Requirements Explained for 2025 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ISO 27001:2022 Requirements Explained for 2025 **[Teleport](https://daily.dev/sources/teleport)** · 11 min read · 0 upvotes · 0 comments ## Summary Organizations must migrate from ISO 27001:2013 to ISO 27001:2022 by October 31, 2025, or risk losing certification. The guide walks through the standard's auditable clauses (4-10), covering context, leadership, planning, support, operation, performance evaluation, and improvement, along with practical examples for each. It also covers Annex A's 93 controls across People, Organizational, Technological, and Physical categories, highlighting new/revised controls addressing cloud infrastructure, hybrid work, and automation. Teleport is presented as a tool that helps align with identity, access, audit, and automation-related controls through its Infrastructure Identity Platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When is the deadline to migrate from ISO 27001:2013 to ISO 27001:2022? Organizations have until October 31, 2025 to complete migration from ISO 27001:2013 to ISO 27001:2022. After this deadline, certifications based on the 2013 standard expire, meaning organizations that haven't transitioned risk losing their certification entirely and must recertify under the new standard. _daily.dev helps compliance and security teams keep track of standards deadlines like this one._ ### How many Annex A controls does ISO 27001:2022 include and are they all mandatory? ISO 27001:2022's Annex A outlines 93 security controls spanning People, Organizational, Technological, and Physical categories. Not all controls must be implemented; organizations complete a Statement of Applicability (SoA) documenting which controls are included or excluded and the rationale, since Annex A functions as a reference framework rather than a mandatory checklist. _security teams weighing which controls to adopt can follow compliance frameworks like ISO 27001 on daily.dev._ ### What new Annex A controls were added in ISO 27001:2022 for cloud and access management? ISO 27001:2022 introduced controls addressing cloud-native infrastructure, hybrid workforces, decentralized identity, and automation, including A.5.7 Threat Intelligence, A.5.23 Information Security for Use of Cloud Services, A.5.30 ICT Readiness for Business Continuity, A.8.9 Configuration Management, A.8.12 Data Leakage Prevention, and A.8.16 Monitoring Activities. _engineers mapping identity and access controls to new standards can track updates like this on daily.dev._ ## Similar posts on daily.dev - [Trust Is Not a Control: ISO 27001 Compliance via GitHub — Daily DevOps & .NET](https://daily.dev/posts/trust-is-not-a-control-iso-27001-compliance-via-github-daily-devops-net-qa3dqds05) · We Are .NET · 0 upvotes · 0 comments - [ISO 42001: The First AI Standard](https://daily.dev/posts/iso-42001-the-first-ai-standard-ebz72ijul) · Security Boulevard · 0 upvotes · 0 comments - [ISO 42001 Evidence: What Auditors Ask For](https://daily.dev/posts/iso-42001-evidence-what-auditors-ask-for-xulcdphqn) · Teleport · 0 upvotes · 0 comments - [Top 10 Cloud Security Standards for Compliance](https://daily.dev/posts/top-10-cloud-security-standards-for-compliance-pa1og7qmr) · Orca Security Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ISO 27001:2022 Requirements Explained for 2025","url":"https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx"},"datePublished":"2026-08-23T12:23:12.590Z","dateModified":"2026-08-23T12:53:12.129Z","description":"Organizations must migrate from ISO 27001:2013 to ISO 27001:2022 by October 31, 2025, or risk losing certification. The guide walks through the standard's...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,compliance","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"ISO 27001:2022 Requirements Explained for 2025"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/iso-27001-2022-requirements-explained-for-2025-wzzepzirx#faq","mainEntity":[{"@type":"Question","name":"When is the deadline to migrate from ISO 27001:2013 to ISO 27001:2022?","acceptedAnswer":{"@type":"Answer","text":"Organizations have until October 31, 2025 to complete migration from ISO 27001:2013 to ISO 27001:2022. After this deadline, certifications based on the 2013 standard expire, meaning organizations that haven't transitioned risk losing their certification entirely and must recertify under the new standard. daily.dev helps compliance and security teams keep track of standards deadlines like this one."}},{"@type":"Question","name":"How many Annex A controls does ISO 27001:2022 include and are they all mandatory?","acceptedAnswer":{"@type":"Answer","text":"ISO 27001:2022's Annex A outlines 93 security controls spanning People, Organizational, Technological, and Physical categories. Not all controls must be implemented; organizations complete a Statement of Applicability (SoA) documenting which controls are included or excluded and the rationale, since Annex A functions as a reference framework rather than a mandatory checklist. security teams weighing which controls to adopt can follow compliance frameworks like ISO 27001 on daily.dev."}},{"@type":"Question","name":"What new Annex A controls were added in ISO 27001:2022 for cloud and access management?","acceptedAnswer":{"@type":"Answer","text":"ISO 27001:2022 introduced controls addressing cloud-native infrastructure, hybrid workforces, decentralized identity, and automation, including A.5.7 Threat Intelligence, A.5.23 Information Security for Use of Cloud Services, A.5.30 ICT Readiness for Business Continuity, A.8.9 Configuration Management, A.8.12 Data Leakage Prevention, and A.8.16 Monitoring Activities. engineers mapping identity and access controls to new standards can track updates like this on daily.dev."}}]} ```