Is there any updated documentation on the ISO/IEC 27001:2022 Azure regulatory compliance initiative?

Question

Is there any updated documentation on the ISO/IEC 27001:2022 Azure regulatory compliance initiative?

Lucas Kuiper 25

The ISO/IEC 27001:2022 initiative is now (finally) included in Azure but it contains some weird required parameters at assigning the initiative that really need some explanation.

Furthermore, what I noticed was that the 2013 version contains 452 policies, whereas the newer 2022 version only has 63 policies. Or should we see this as an add-on to the set of policies in the 2013 version? When searching for an explanation in the documentation at ISO/IEC 27001 - Azure Compliance | Microsoft Learn the 2022 version is mentioned but everything else is still based on the 2013 version and only links to an overview of the policies in the 2013 initiative.

It would be helpful if someone could elaborate on this!

Also check:
https://learn.microsoft.com/en-us/answers/questions/1414185/azure-initiative-for-iso-27001-2022

Siva shunmugam Nadessin 575 Reputation points Microsoft External Staff Moderator

2025-08-15T00:21:26.43+00:00
Hello Lucas Kuiper,

Here’s the current situation:

ISO/IEC 27001:2013 is the older version of the Information Security Management System (ISMS) standard.

ISO/IEC 27001:2022 was published in October 2022 as the updated version.

The International Accreditation Forum (IAF) has set a transition period of 3 years from the publication date (until 31 October 2025).

During this transition period:

New certifications should ideally be issued against ISO 27001:2022.

Existing ISO/IEC 27001:2013 certificates remain valid, but organizations must transition to the 2022 version before the deadline.

So right now (August 2025):

You can still be certified under ISO/IEC 27001:2013, but only for a very short period.

Since the cut-off is 31 October 2025, you should already be planning or completing your transition to ISO 27001:2022.

If you start a certification process now, it makes sense to go directly to ISO27001:2022 to avoid rework.

so it's advisable to keep checking the official Azure Compliance Documentation for the latest updates.

Reference document:

https://www.iso.org/standard/27001

[This document is not maintained by Microsoft. It is being shared solely for your convenience.]

If the comment was helpful, please click "Upvote".

Thanks,

Siva shunmugam.
Lucas Kuiper 25 Reputation points

2025-08-22T10:41:50.9166667+00:00

The above information is not an answer to my questions!
Siva shunmugam Nadessin 575 Reputation points Microsoft External Staff Moderator

2025-08-23T01:37:46.6566667+00:00
Hello Lucas Kuiper,

The above answer is the to your question “what I noticed was that the 2013 version contains 452 policies, whereas the newer 2022 version only has 63 policies. Or should we see this as an add-on to the set of policies in the 2013 version?”

We have tried to understand your question and below is the compiled answer.

Policy Count and Versioning: The reduction from 452 policies in the 2013 version to 63 in the 2022 version doesn't necessarily mean the 2022 version is lacking; it has undergone a refinement. The ISO/IEC 27001:2022 standard has consolidated and realigned its controls and management processes, possibly introducing new domains while removing redundancies from the previous set.

Transition Period: You also mentioned the transition period. The ISO 27001:2022 standard allows existing ISO 27001:2013 certifications to remain valid until October 31, 2025. This means that organizations can still maintain their 2013 certifications while preparing to comply with the updated standard.

Documentation Updates: For the latest information, it's crucial to keep an eye on the official Azure Compliance Documentation. As Microsoft continues to update the documentation, it is expected that new details and insights about the 2022 initiative will appear.

Built-In Initiatives: If you are looking for how to implement the new standards within Azure, take a look at the built-in regulatory compliance initiatives in Azure Policy, which map directly to the controls and compliance domains of the ISO/IEC 27001 standard. This will assist in enforcing organizational standards and assessing compliance effectively. Links to these initiatives can be found in the compliance documentation as well.

Hope this helps clarify your questions! If you need further specifics, feel free to ask. It might be useful to know what particular aspects of the compliance initiative you're struggling with or if there are certain parameters you'd like more explanations on.

If the comment was helpful, please click "Upvote".

Thanks,

Siva shunmugam.
Lucas Kuiper 25 Reputation points

2025-08-23T20:36:41.66+00:00
Hello Siva,

Thanks for the additional clarification on the first answer;

Policy Count and Versioning: this is indeed one of the answers I was looking for. So the new 63 policies are a complete set that replaces the older 452 policies. Now it is clear!

Transition Period: Not something I specifically asked for but it is helpful information.

Documentation Updates: currently it still refers to the 2013 initiative. I hope this will be updated soon.

Built-In Initiatives: The problem here is not so much about how policies are mapped to controls but is in the assignment part. There seem to be multiple duplicated required parameters that don't really seem to make any sense. What information should be supplied in these parameters and why are they required? This is the part where some updated documention would come in very handy:

Accepted answer

0 additional answers

Your answer

Siva shunmugam Nadessin 575 Reputation points Microsoft External Staff Moderator

2025-08-15T00:21:26.43+00:00

Hello Lucas Kuiper,

Here’s the current situation:

ISO/IEC 27001:2013 is the older version of the Information Security Management System (ISMS) standard.

ISO/IEC 27001:2022 was published in October 2022 as the updated version.

The International Accreditation Forum (IAF) has set a transition period of 3 years from the publication date (until 31 October 2025).

During this transition period:

New certifications should ideally be issued against ISO 27001:2022.

Existing ISO/IEC 27001:2013 certificates remain valid, but organizations must transition to the 2022 version before the deadline.

So right now (August 2025):

You can still be certified under ISO/IEC 27001:2013, but only for a very short period.

Since the cut-off is 31 October 2025, you should already be planning or completing your transition to ISO 27001:2022.

If you start a certification process now, it makes sense to go directly to ISO27001:2022 to avoid rework.

so it's advisable to keep checking the official Azure Compliance Documentation for the latest updates.

Reference document:

https://www.iso.org/standard/27001

[This document is not maintained by Microsoft. It is being shared solely for your convenience.]

If the comment was helpful, please click "Upvote".

Thanks,

Siva shunmugam.
Lucas Kuiper 25 Reputation points

2025-08-22T10:41:50.9166667+00:00

The above information is not an answer to my questions!
Lucas Kuiper 25 Reputation points

2025-08-23T20:36:41.66+00:00

Hello Siva,

Thanks for the additional clarification on the first answer;

Policy Count and Versioning: this is indeed one of the answers I was looking for. So the new 63 policies are a complete set that replaces the older 452 policies. Now it is clear!

Transition Period: Not something I specifically asked for but it is helpful information.

Documentation Updates: currently it still refers to the 2013 initiative. I hope this will be updated soon.

Built-In Initiatives: The problem here is not so much about how policies are mapped to controls but is in the assignment part. There seem to be multiple duplicated required parameters that don't really seem to make any sense. What information should be supplied in these parameters and why are they required? This is the part where some updated documention would come in very handy:

Answer 1

Siva shunmugam Nadessin 575 Microsoft External Staff Moderator

Hello Lucas Kuiper,

As you asked for document related to Parameters below is the one which discusses on the same.

Quickstart: Create policy assignment using Azure portal - Azure Policy | Microsoft Learn

If you're seeing multiple or confusing parameters (like repeated "Include Arc connected servers"), it may be due to nested policy definitions or initiative-level assignments where each policy has its own parameter set.

To know more about the Azure Policy & Azure Definition look into the below document.

Overview of Azure Policy - Azure Policy | Microsoft Learn

Azure Policy glossary - Azure Policy | Microsoft Learn

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Thanks,

Siva shunmugam.

Lucas Kuiper 25 Reputation points

2025-08-26T09:46:41.8433333+00:00

It seems that in the meanwhile (since I ran into this 'problem') the ISO/IEC 27001:2022 initiative has been updated to a newer version. Version 1.2 no longer contains the confusing parameters as shown in the screenshot I posted before. Only two repeated "include Arc Connected servers" paramaters are left but that is not blocking for the assignment. So, my initiative assignment issue is solved with using the newest (1.2) version of the ISO/IEC 27001:2022 initiative.
Lucas Kuiper 25 Reputation points

2025-08-28T11:06:55.93+00:00

One additional question: in the policy definitions overview the name is displayed as "ISO/IEC 27001 2022" but after assigning the initiative it is displayed as "Azure ISO IEC 27001:2022(Preview) in the Defender for Cloud regulatory compliance dashboard:

What does that mean? The same applies to the CIS initiative.
Siva shunmugam Nadessin 575 Reputation points Microsoft External Staff Moderator

2025-08-30T01:47:28.7633333+00:00

Hello Lucas Kuiper,

The Preview here indicates that the initiative is still undergoing refinement or is newly released.

Share via

Is there any updated documentation on the ISO/IEC 27001:2022 Azure regulatory compliance initiative?

0 additional answers

Your answer