ISO/IEC 27001 remains the most widely recognized standard for information security management, and in the UAE it is increasingly a condition of doing business. Government entities, banks and multinational clients routinely ask suppliers for an ISO 27001 certificate during tenders and vendor due diligence. Several local frameworks, including the UAE Information Assurance Standard and Dubai's Information Security Regulation, are built on the same management system principles.
The 2022 revision changed how controls are structured and added requirements that reflect how organizations operate today, with more cloud services, more remote work and more scrutiny from regulators. The cost of getting security wrong is also rising: IBM's 2026 Cost of a Data Breach research puts the average cost of a breach for organizations in the Middle East at $8 million. This guide explains what changed in ISO 27001:2022, what the end of the transition period means for your certificate, and how to approach implementation and certification in a practical way.
What is ISO 27001:2022?
ISO/IEC 27001:2022 is the current edition of the international standard that sets out the requirements for an information security management system (ISMS). An ISMS is the set of policies, processes, roles and controls an organization uses to identify information security risks and manage them in a consistent, measurable way. ISO and IEC published the standard in October 2022, and it is the edition that accredited certification bodies now audit against.
Organizations certify against ISO 27001 only. Its companion standard, ISO/IEC 27002:2022, gives detailed guidance on implementing each control, but it cannot be certified on its own.
What changed in ISO 27001:2022 compared with ISO 27001:2013?
Annex A has been restructured into four themes
The most visible change is the control set in Annex A. The 114 controls in 14 domains of the 2013 edition have been consolidated into 93 controls across four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organizational | 37 | Information security policies, supplier relationships, asset management, incident management, business continuity |
| People | 8 | Screening, terms of employment, awareness and training, remote working, confidentiality agreements |
| Physical | 14 | Secure areas, equipment security, clear desk and clear screen, physical security monitoring |
| Technological | 34 | Access control, cryptography, logging and monitoring, secure development, vulnerability management |
Most 2013 controls were merged rather than removed, so the lower number does not mean less work. ISO/IEC 27002:2022 also introduces control attributes, such as control type and cybersecurity concept, which help organizations filter and report on their controls.
Eleven new controls
The 2022 edition adds eleven controls that reflect current threats and ways of working:
| Control | Name | What it means in practice |
|---|---|---|
| 5.7 | Threat intelligence | Collect and analyze information about threats relevant to your organization, and use it to adjust your controls. |
| 5.23 | Information security for use of cloud services | Define how cloud services are acquired, used, managed and exited, including where your responsibilities end and the provider's begin. |
| 5.30 | ICT readiness for business continuity | Plan and test ICT readiness so critical systems recover within agreed objectives. |
| 7.4 | Physical security monitoring | Monitor premises continuously for unauthorized physical access, for example through CCTV and alarm systems. |
| 8.9 | Configuration management | Establish, document and monitor secure configurations for hardware, software, services and networks. |
| 8.10 | Information deletion | Delete information when it is no longer required, in line with legal and contractual obligations. |
| 8.11 | Data masking | Mask sensitive data, such as personal data, in line with your access control policy and legal requirements. |
| 8.12 | Data leakage prevention | Apply measures to detect and prevent unauthorized disclosure of sensitive information. |
| 8.16 | Monitoring activities | Monitor networks, systems and applications for anomalous behavior, and act on what you find. |
| 8.23 | Web filtering | Manage access to external websites to reduce exposure to malicious content. |
| 8.28 | Secure coding | Apply secure coding principles throughout software development. |
Several of these controls overlap with services organizations already run. Data leakage prevention is often addressed through a DLP solution, monitoring activities through a SIEM or security operations center, and secure coding through source code review. Cloud services security deserves particular attention, because most organizations now rely on several cloud providers; see our approach to cloud security and our guide to cloud security posture management.
Changes to the management clauses (Clauses 4 to 10)
The core requirements in Clauses 4 to 10 were revised to align with the harmonized structure ISO uses for all management system standards. The most practical changes are:
A new Clause 6.3, Planning of changes, which requires changes to the ISMS to be carried out in a planned manner.
Clause 4.2 now asks organizations to determine which requirements of interested parties will be addressed through the ISMS.
Clause 6.2 requires information security objectives to be monitored.
Clause 8.1 refers explicitly to controlling externally provided processes, products or services that are relevant to the ISMS.
Clauses 9.2 and 9.3 (internal audit and management review) are split into sub-clauses, and management reviews must now consider changes in the needs and expectations of interested parties.
The 2024 climate action amendment
In February 2024, ISO published Amendment 1 to ISO/IEC 27001:2022. It adds a requirement in Clause 4.1 for organizations to determine whether climate change is a relevant issue, and a note in Clause 4.2 that interested parties can have climate-related requirements. In practice, this means recording a reasoned decision in your context analysis, for example how extreme heat, flooding or power disruption could affect your data centers, offices or key suppliers.
Can organizations still transition from ISO 27001:2013?
No. Under IAF MD 26, the transition requirements published by the International Accreditation Forum, certification bodies had to complete all transitions by 31 October 2025. Every accredited certificate issued against the 2013 edition expired or was withdrawn on that date, regardless of the expiry date printed on it.
If your organization's 2013 certificate lapsed, it cannot be restored. You will need a new initial certification against the 2022 edition, including Stage 1 and Stage 2 audits. Much of your existing ISMS, such as the scope, risk methodology and policies, can usually be reused after a structured gap assessment against the 2022 requirements.
Why ISO 27001 matters for organizations in the UAE
Beyond international recognition, ISO 27001 gives UAE organizations a single management system that supports several local regulatory requirements:
UAE Information Assurance Standard (formerly NESA). It applies to government entities and critical infrastructure, and an ISO 27001 ISMS provides much of the governance and risk management structure it expects. Learn more about UAE IA compliance and our overview of government cybersecurity frameworks in MENA.
Dubai Information Security Regulation (ISR). Issued by the Dubai Electronic Security Center for Dubai Government entities and their suppliers, the ISR is aligned with ISO 27001.
Central Bank of the UAE. Banks and licensed financial institutions are expected to run a structured information security program, and ISO 27001 is a common foundation. See our CBUAE compliance services and our article on digital banking security.
ADHICS. Healthcare entities in Abu Dhabi can map many controls of the Abu Dhabi Healthcare Information and Cyber Security Standard to an existing ISMS. Read about our ADHICS compliance services and our article on healthcare cybersecurity.
Client and tender requirements. International clients, SaaS customers and procurement teams increasingly ask for ISO 27001 certification, often alongside a SOC 2 report. Our guide to preparing for SOC 2 Type II explains how the two fit together.
UAE Personal Data Protection Law (PDPL). ISO 27001 security controls support the PDPL requirement to protect personal data. See our UAE PDPL implementation guide.
Choose a certification body accredited by a member of the International Accreditation Forum, such as the Emirates International Accreditation Centre (EIAC), so that your certificate is recognized internationally.
A step-by-step ISO 27001:2022 implementation roadmap
Every organization's path is different, but successful implementations tend to follow the same sequence.
1. Secure leadership commitment and define the scope
Agree who owns the ISMS, and which locations, business units, systems and cloud services are in scope. A scope that is too broad slows the project down. One that is too narrow may not satisfy your clients or regulators.
2. Run a gap assessment
Compare your current policies, processes and controls against Clauses 4 to 10 and the 93 Annex A controls. The output should be a prioritized remediation plan with owners and target dates. Our internal audit and gap analysis service is designed for this stage.
3. Define your risk methodology and assess risks
Document how you identify, analyze and evaluate risks, including your risk acceptance criteria. Then assess the risks to the confidentiality, integrity and availability of the information in scope. A structured risk assessment at this stage drives every decision that follows.
4. Treat risks and prepare the Statement of Applicability
Select controls to treat each risk, and record them in the Statement of Applicability (SoA) with a justification for including or excluding each Annex A control. Auditors examine the SoA closely, so the reasoning should be specific to your organization rather than copied from a template.
5. Implement controls and write the supporting policies
Put the selected controls into operation, for example access reviews, secure configuration baselines, supplier security clauses and incident response procedures, and document them in practical information security policies that staff can actually follow.
6. Build awareness and competence
Train employees on their responsibilities, and keep evidence of competence for key roles. People controls are where many organizations fall short during the Stage 2 audit.
7. Monitor, measure and audit internally
Track your information security objectives and metrics, then carry out a full internal audit of the ISMS before the certification audit. Technical testing, such as vulnerability assessment and penetration testing, provides useful evidence for several technological controls.
8. Hold a management review and close nonconformities
Top management reviews ISMS performance, audit results and changes, and approves improvements. Any nonconformities raised in the internal audit should be closed with documented corrective actions.
Once the ISMS has operated long enough to produce records, typically two to three months, the certification body carries out the Stage 1 audit, which reviews your documentation and readiness, followed by the Stage 2 audit, which assesses whether your controls are implemented and effective.
ISO 27001:2022 mandatory documentation checklist
The standard requires the following documented information as a minimum:
| Document or record | Clause |
|---|---|
| Scope of the ISMS | 4.3 |
| Information security policy | 5.2 |
| Information security risk assessment process | 6.1.2 |
| Information security risk treatment process | 6.1.3 |
| Statement of Applicability | 6.1.3 d) |
| Information security objectives | 6.2 |
| Evidence of competence | 7.2 |
| Documented information needed for operational planning and control | 8.1 |
| Results of information security risk assessments | 8.2 |
| Results of information security risk treatment | 8.3 |
| Evidence of monitoring and measurement results | 9.1 |
| Internal audit programme and results | 9.2 |
| Results of management reviews | 9.3 |
| Nonconformities and corrective actions | 10.2 |
The Annex A controls you select may require additional documentation, such as an access control policy or an incident response procedure.
How long does ISO 27001 certification take in the UAE?
Timelines depend on the size of your organization, your scope and how mature your existing security practices are. Based on Intello's engagements, small and medium-sized businesses typically achieve certification in four to six months, while enterprise implementations usually take six to twelve months. With an accelerated program and a well-prepared team, certification in three to four months is achievable.
An ISO 27001 certificate is valid for three years. The certification body carries out surveillance audits in the first and second years, followed by a recertification audit before the certificate expires.
Common ISO 27001 implementation mistakes to avoid
Treating ISO 27001 as a documentation exercise. Auditors look for evidence that controls operate, not only that policies exist.
Using a generic risk assessment. Risks and treatments should reflect your actual assets, threats and business context.
Weak justifications in the Statement of Applicability. Marking a control "not applicable" without a reason is a common audit finding.
Overlooking cloud and supplier risks. Controls 5.19 to 5.23 expect you to manage the security of the services you depend on.
Skipping the internal audit or management review. Both must be completed before the certification audit.
Losing momentum after certification. Surveillance audits check that the ISMS continues to operate and improve.
How Intello supports ISO 27001:2022 implementation
Intello has delivered information security and compliance programs for organizations across the UAE since 2003. Our ISO 27001 consultants support you from gap assessment and risk assessment through to policy development, internal audit and certification audit support. Where they apply, we align your ISMS with UAE IA, Dubai ISR and ADHICS requirements, and with ISO 42001 if you are building or using AI systems.
Talk to our ISO 27001 team or book a free security assessment.
Frequently asked questions
What is the difference between ISO 27001:2013 and ISO 27001:2022?
The 2022 edition reorganizes Annex A into 93 controls across four themes, down from 114 controls in 14 domains. It adds 11 new controls, such as threat intelligence and data leakage prevention, and updates Clauses 4 to 10 to align with ISO's harmonized structure for management system standards.
Is ISO 27001:2013 certification still valid?
No. All accredited ISO 27001:2013 certificates expired or were withdrawn on 31 October 2025. Organizations now need certification against ISO 27001:2022.
How many controls are in ISO 27001:2022 Annex A?
There are 93 controls, grouped into four themes: Organizational (37), People (8), Physical (14) and Technological (34).
How long does ISO 27001 certification take in the UAE?
Typically four to six months for small and medium-sized businesses and six to twelve months for larger enterprises, depending on scope and existing security maturity.
Is ISO 27001 mandatory in the UAE?
ISO 27001 is not legally mandatory for every organization, but clients and tenders frequently require it. It also supports compliance with frameworks such as the UAE Information Assurance Standard and the Dubai Information Security Regulation.
Who issues ISO 27001 certificates in the UAE?
Certificates are issued by independent certification bodies. Choose one accredited by a member of the International Accreditation Forum, such as the Emirates International Accreditation Centre (EIAC), so that your certificate is recognized internationally.