Kuwaiti businesses handling customer information, financial records, employee data, and confidential business documents need clear processes to manage information security risks. ISO/IEC 27001:2022 provides a framework for establishing, maintaining, and improving an Information Security Management System (ISMS). Its Annex A reference set contains 93 controls across four categories: organizational, people, physical, and technological.
For businesses moving from the 2013 edition, the ISO 27001:2022 transition involves more than updating policy documents. Organizations need to review risks, assess control gaps, revise their Statement of Applicability, and demonstrate that relevant security measures work in practice. ISO Consultancy Kuwait is a starting point for businesses researching implementation and transition support.
An important date to note is 31 October 2025. Under the International Accreditation Forum’s transition requirements, accredited certification bodies were required to complete the transition of certified clients to ISO/IEC 27001:2022 by this date. Companies that still hold an old-edition certificate should contact their certification body promptly to establish their current certification status.
What Changed from ISO 27001:2013 to ISO 27001:2022?
The 2022 edition reorganized Annex A to align with ISO/IEC 27002:2022. The reference set changed from 114 controls to 93, with 11 new controls, 24 merged controls, and 58 updated controls. The four categories replaced the previous 14-domain structure.
| Area | ISO 27001:2013 | ISO 27001:2022 |
| Annex A controls | 114 | 93 |
| Structure | 14 domains | 4 categories |
| New controls | Not applicable | 11 introduced |
| Main assessment focus | Existing control framework | Review risks, applicability, and implementation against the revised set. |
The four categories contain 37 organizational controls, 8 people controls, 14 physical controls, and 34 technological controls.
ISO 27001:2022 Transition Checklist for Kuwaiti Companies
Use this checklist to plan the ISO 27001:2022 transition, assign responsibilities, and record evidence of completion.
Step 1: Review Your Existing ISMS
Confirm the scope of your existing ISMS, including business activities, locations, information assets, systems, and third-party services. Review current policies, risk assessments, audit findings, and management review records.
Identify changes since the previous certification audit, such as new cloud applications, remote-working arrangements, suppliers, or business processes.
Step 2: Conduct a Gap Assessment
Compare existing controls and procedures with the 2022 requirements. Record missing controls, outdated documents, and measures that exist on paper but are not consistently applied.
Assign each gap an owner, priority, corrective action, and target completion date.
Step 3: Review All 93 Annex A Controls
Assess the controls against your information security risks. Determine whether existing measures remain suitable, require revision, or need additional implementation evidence. Consider the risks associated with customer records, financial information, employee data, business applications, and third-party services.
Step 4: Update the Statement of Applicability
The Statement of Applicability (SoA) identifies the necessary controls, explains their inclusion or exclusion, and records their implementation status. Update it to reflect the risk assessment, selected risk treatment measures, and relevant requirements.
Step 5: Update Risk Assessments and Treatment Plans
Review threats involving unauthorized access, data loss, system outages, supplier incidents, and technical vulnerabilities. Document risk owners, treatment decisions, and residual risks in line with your ISMS process.
Step 6: Revise Policies, Procedures, and Evidence
Update relevant security policies, access reviews, incident records, backup procedures, supplier assessments and other supporting documentation. Ensure that records reflect actual business practices rather than procedures that exist only on paper.
Step 7: Train Employees and Relevant Personnel
Explain updated responsibilities, incident reporting procedures, access requirements, and remote-working rules. Keep attendance records and assess whether employees understand their duties.
Step 8: Conduct an Internal Audit and Management Review
Check whether the ISMS meets applicable requirements and whether selected controls operate as intended. Record nonconformities, corrective actions and management decisions. Management should review outstanding risks and confirm whether further action is needed.
Step 9: Close Gaps and Contact Your Certification Body
Complete corrective actions, organize supporting evidence, and agree the appropriate assessment arrangements with your certification body. As the transition deadline has passed, do not assume an old-edition certificate remains valid. Confirm the certificate’s current status and the steps required to address any outstanding issues.
ISO 27001:2022 Annex A: All 93 Controls Explained
The following reference checklist covers all 93 control identifiers and their main purposes. Use it alongside the official standard when conducting a formal assessment. These summaries explain the purpose of each control but do not replace the complete requirements and guidance in the standard.
1. Organisational Controls: 37 Controls
| Control | Main purpose |
| 5.1 Policies for information security | Establish and review security policies. |
| 5.2 Information security roles and responsibilities | Assign security duties and accountability. |
| 5.3 Segregation of duties | Separate conflicting responsibilities. |
| 5.4 Management responsibilities | Ensure management requires staff to follow security rules. |
| 5.5 Contact with authorities | Maintain relevant regulatory and emergency contacts. |
| 5.6 Contact with special interest groups | Access relevant security knowledge and professional networks. |
| 5.7 Threat intelligence | Collect and analyse information about security threats. |
| 5.8 Information security in project management | Address security throughout project delivery. |
| 5.9 Inventory of information and other associated assets | Maintain an accurate asset inventory. |
| 5.10 Acceptable use of information and other associated assets | Define permitted use and handling rules. |
| 5.11 Return of assets | Recover company assets when required. |
| 5.12 Classification of information | Classify information according to its protection needs. |
| 5.13 Labelling of information | Apply suitable classification labels. |
| 5.14 Information transfer | Protect information when it is transferred. |
| 5.15 Access control | Establish rules for access to information and assets. |
| 5.16 Identity management | Manage identities throughout their lifecycle. |
| 5.17 Authentication information | Protect passwords, credentials and other authentication data. |
| 5.18 Access rights | Grant, review, change and remove access rights. |
| 5.19 Information security in supplier relationships | Manage risks associated with suppliers. |
| 5.20 Addressing information security within supplier agreements | Include relevant security requirements in contracts. |
| 5.21 Managing information security in the ICT supply chain | Address risks across technology supply chains. |
| 5.22 Monitoring, review and change management of supplier services | Review supplier performance and service changes. |
| 5.23 Information security for use of cloud services | Govern cloud acquisition, use and exit. |
| 5.24 Information security incident management planning and preparation | Prepare incident response arrangements. |
| 5.25 Assessment and decision on information security events | Decide whether events constitute incidents. |
| 5.26 Response to information security incidents | Respond to incidents using established procedures. |
| 5.27 Learning from information security incidents | Use incident findings to improve security. |
| 5.28 Collection of evidence | Preserve evidence appropriately. |
| 5.29 Information security during disruption | Maintain suitable security during disruptions. |
| 5.30 ICT readiness for business continuity | Prepare ICT services to support continuity. |
| 5.31 Legal, statutory, regulatory and contractual requirements | Identify and meet applicable obligations. |
| 5.32 Intellectual property rights | Protect intellectual property. |
| 5.33 Protection of records | Safeguard records against loss, alteration, and unauthorized access. |
| 5.34 Privacy and protection of PII | Protect personally identifiable information and privacy. |
| 5.35 Independent review of information security | Obtain independent reviews of the security approach. |
| 5.36 Compliance with policies, rules, and standards for information security | Check compliance with internal security requirements. |
| 5.37 Documented operating procedures | Maintain necessary operating instructions. |
Practical example: A Kuwaiti company using an external cloud accounting platform should assess the supplier, document security responsibilities, restrict access, classify financial records, and establish arrangements for service disruption and data recovery.
2. People Controls: 8 Controls
| Control | Main purpose |
| 6.1 Screening | Conduct appropriate pre-employment and ongoing checks where relevant. |
| 6.2 Terms and conditions of employment | Include information security responsibilities in employment terms. |
| 6.3 Information security awareness, education, and training | Build employee security knowledge and skills. |
| 6.4 Disciplinary process | Establish procedures for security policy violations. |
| 6.5 Responsibilities after termination or change of employment | Maintain security obligations during role changes and departure. |
| 6.6 Confidentiality or non-disclosure agreements | Protect confidential information through appropriate agreements. |
| 6.7 Remote working | Protect information accessed outside company premises. |
| 6.8 Information security event reporting | Enable timely reporting of suspected security events. |
3. Physical Controls: 14 Controls
| Control | Main purpose |
| 7.1 Physical security perimeters | Define protected physical boundaries. |
| 7.2 Physical entry | Control entry to secure areas. |
| 7.3 Securing offices, rooms, and facilities | Protect offices and sensitive facilities. |
| 7.4 Physical security monitoring | Monitor premises for unauthorized access. |
| 7.5 Protecting against physical and environmental threats | Address fire, flooding, and other environmental risks. |
| 7.6 Working in secure areas | Establish safeguards for secure-area activities. |
| 7.7 Clear desk and clear screen | Prevent exposure of unattended information. |
| 7.8 Equipment siting and protection | Position and protect equipment appropriately. |
| 7.9 Security of assets off-premises | Protect equipment used outside company premises. |
| 7.10 Storage media | Manage storage media through its lifecycle. |
| 7.11 Supporting utilities | Protect power and other supporting utilities. |
| 7.12 Cabling security | Protect power and data cables from damage or interception. |
| 7.13 Equipment maintenance | Maintain equipment securely and reliably. |
| 7.14 Secure disposal or reuse of equipment | Remove sensitive information before disposal or reuse. |
Practical example: A business office could use visitor logs, restricted server-room access, secure document storage, screen locks, and approved procedures for disposing of old computers.
4. Technological Controls: 34 Controls
| Control | Main purpose |
| 8.1 User endpoint devices | Secure laptops, mobiles, and other endpoints. |
| 8.2 Privileged access rights | Restrict and monitor elevated permissions. |
| 8.3 Information access restriction | Limit access to information according to need. |
| 8.4 Access to source code | Restrict and control access to source code. |
| 8.5 Secure authentication | Apply suitable authentication mechanisms. |
| 8.6 Capacity management | Monitor and manage resource capacity. |
| 8.7 Protection against malware | Prevent, detect, and respond to malicious software. |
| 8.8 Management of technical vulnerabilities | Identify and address technical vulnerabilities. |
| 8.9 Configuration management | Maintain secure system configurations. |
| 8.10 Information deletion | Delete information when no longer required. |
| 8.11 Data masking | Conceal sensitive data where appropriate. |
| 8.12 Data leakage prevention | Reduce unauthorised disclosure or transfer of information. |
| 8.13 Information backup | Maintain and test backups. |
| 8.14 Redundancy of information processing facilities | Provide suitable redundancy for availability. |
| 8.15 Logging | Record relevant system and user activities. |
| 8.16 Monitoring activities | Monitor systems for unusual or suspicious behaviour. |
| 8.17 Clock synchronization | Synchronize system clocks for reliable records. |
| 8.18 Use of privileged utility programs | Restrict powerful administrative utilities. |
| 8.19 Installation of software on operational systems | Control software installation on live systems. |
| 8.20 Network security | Secure networks and network devices. |
| 8.21 Security of network services | Define and monitor network service security. |
| 8.22 Segregation of networks | Separate networks according to security needs. |
| 8.23 Web filtering | Restrict access to harmful or inappropriate web content. |
| 8.24 Use of cryptography | Apply suitable encryption and key management. |
| 8.25 Secure development life cycle | Integrate security throughout software development. |
| 8.26 Application security requirements | Define security requirements for applications. |
| 8.27 Secure system architecture and engineering principles | Apply security principles to system design. |
| 8.28 Secure coding | Reduce vulnerabilities during software development. |
| 8.29 Security testing in development and acceptance | Test security before systems are accepted. |
| 8.30 Outsourced development | Govern and monitor outsourced software development. |
| 8.31 Separation of development, test and production environments | Separate environments to reduce risk. |
| 8.32 Change management | Control and document system changes. |
| 8.33 Test information | Protect information used for testing. |
| 8.34 Protection of information systems during audit testing | Limit risks caused by audit tests. |
These tables provide a working overview of the 93 controls. During an assessment, record each control’s applicability, implementation status, supporting evidence, and any corrective action required.
Kuwait-Specific Transition Considerations
During the ISO 27001:2022 Transition, companies should map their ISMS to the Kuwaiti legal and sector-specific obligations that apply to their operations. Certification does not automatically establish compliance with every applicable law or regulatory requirement.
Data Privacy
Review the applicable CITRA Data Privacy Protection Regulation and related requirements where the organisation falls within its scope. Consider personal data handling, access restrictions, security measures, and incident procedures.
Cloud Services
Review CITRA’s Cloud Regulatory Framework where applicable, including relevant contractual, data protection and incident-reporting requirements.
Financial Services
Banks and other regulated financial entities should assess applicable Central Bank of Kuwait requirements, including its Cyber & Operational Resilience Framework and relevant outsourcing or cloud requirements.
Contracts and Suppliers
Check customer agreements, outsourcing arrangements and international clients’ security requirements. Ensure that suppliers understand their security responsibilities and that relevant contractual commitments are documented.
Business Continuity
Ensure backup, recovery, and incident-response arrangements reflect the company’s actual systems, operating conditions, and risk exposure.
The applicable obligations depend on the organization’s activities and regulatory status. Seek qualified local advice when interpreting specific legal requirements.
Documents and Records to Prepare
Prepare and review the following evidence as part of the transition assessment.
| Document or record | What it should demonstrate |
| ISMS scope and security policies | Defined boundaries, responsibilities, and security rules |
| Risk assessment and treatment plan | Identified risks, treatment decisions, owners, and progress |
| Statement of Applicability | Control applicability, justifications, and implementation status |
| Asset inventory and classification records | Identified assets, owners and protection requirements |
| Access and identity records | Authorised access, privilege reviews, and account removal |
| Supplier and cloud assessments | Evaluated third-party risks and agreed security requirements |
| Incident and backup records | Response procedures, incident handling, and recovery testing |
| Training records | Employee awareness and relevant role-based training |
| Internal audit and management review records | Audit findings, management decisions, and follow-up actions taken |
| Corrective action records | Root causes, actions taken and effectiveness checks |
An auditor may request additional evidence depending on the ISMS scope, risks, and assessment arrangements. The aim is to demonstrate that controls operate effectively, not simply that documents exist.
Conclusion: Prepare Your ISMS for the 2022 Edition
The ISO 27001:2022 Transition requires Kuwaiti companies to review their risk assessments, verify the applicability of all 93 Annex A controls, update documentation, and confirm that relevant safeguards work in practice. Because the transition deadline has passed, businesses still relying on an old-edition certificate should establish their current position with their certification body without delay.
Organizations comparing iso 27001 certified companies can review certification scope and accreditation, while businesses researching iso 27001 certification companies should distinguish certification providers from consultants. ISO Consultancy Kuwait can be explored for information on implementation and transition support, including gap assessment and audit preparation. Businesses seeking iso 27001 consulting services should choose support that fits their ISMS scope, internal resources, and identified risks.
Frequently Asked Questions
How many controls are in ISO 27001:2022?
Annex A contains 93 controls: 37 organizational, 8 people, 14 physical, and 34 technological controls.
Are all 93 Annex A controls mandatory?
No. Organizations must determine which controls are necessary to address their information security risks and meet applicable requirements. The Statement of Applicability records which controls are included or excluded and the reasons for those decisions.
What is the ISO 27001:2022 transition deadline?
The International Accreditation Forum’s transition deadline for completing the transition of certified clients was 31 October 2025. Organizations that have not completed the transition should contact their certification body to clarify their certificate status and available next steps.
Can a company complete the transition without a consultant?
Yes. An organisation with suitable internal expertise can manage its own ISMS updates. External support may be useful when the team needs assistance with gap assessments, risk treatment, documentation or audit preparation.
What should businesses look for in a certification provider?
Check the provider’s accreditation, the scope of its accreditation, and its authority to certify information security management systems. Consultancy and certification are different functions. Organizations should not assume that a consultant can issue an accredited certificate.