Singahi releases free ISO 27001:2022 guide with 93 controls

Singahi has finished a free, one-control-at-a-time implementation guide for ISO/IEC 27001:2022, covering all 93 Annex A controls as companies move to the revised standard. The launch matters because ISO 27001 is now a common procurement and investor requirement, and the old 2013 certificates are no longer valid.

Why it matters: - ISO 27001 certification is now a common requirement in enterprise procurement and investor due diligence. - The transition period for ISO/IEC 27001:2022 ended on 31 October 2025, so certificates issued against ISO 27001:2013 are no longer valid. - Growing companies now need to work to the revised Annex A when certifying or renewing.

What happened: - Singahi announced the completion of a free implementation guide to ISO/IEC 27001:2022. - The guide now covers all 93 Annex A controls. - Singahi began publishing the guide on 1 July 2026 and added one control a day. - The final instalment went live on 1 October 2026. - The guide is available now at Singahi's ISO 27001 toolkit.

The details: - ISO/IEC 27001:2022 restructures the previous 114 controls into 93 controls. - The controls are grouped into four themes: organisational, people, physical and technological. - The revision adds 11 new controls covering areas such as threat intelligence, cloud services, data leakage prevention, data masking and secure coding. - Each control has a plain-language article explaining what the requirement means, how organisations typically implement it and the questions auditors commonly raise. - The articles also address Indian regulatory requirements where relevant, including the Digital Personal Data Protection Act, 2023, plus RBI and SEBI guidance. - Each article includes a downloadable Control Pack with templates and working documents. - Typical Control Pack materials include a policy template, a supporting procedure, implementation and audit-evidence checklists, a risk register, KPIs, a gap analysis, a RACI matrix and an implementation roadmap. - The articles are open to read without registration. - The Control Packs are free to download after a short sign-up.

Between the lines: - Singahi is targeting a common gap in ISO 27001 readiness work: companies often have the technology in place but lack documentation that auditors can follow. - The guide is designed to help certification leads start from a working draft rather than a blank page. - Singahi says many organizations misunderstand Annex A and assume every control is mandatory. - In practice, organizations determine which controls they need through risk assessment and treatment, then record the decisions and justifications in a Statement of Applicability. - The format also positions Singahi as a lead-generation tool for consulting work, since the company also offers gap assessments, internal audits and implementation support.

What's next: - Singahi plans three more guides in the same format. - The ISO 22301 guide on business continuity management starts on 2 October 2026 and will run to 26 articles. - The ISO 22301 series will cover business impact analysis, continuity strategies, business continuity plans and exercise programmes. - The ISO 22301 guide will map to ISO 27001 where the standards overlap. - The ISO/IEC 27701 guide is expected from late October and will follow the 2025 edition of the privacy standard. - Singahi expects the ISO/IEC 27701 guide to matter for Indian organizations preparing for the DPDP Rules, 2025, most of which take effect in May 2027. - The ISO/IEC 42001 guide is expected from December 2026 and will cover AI management systems. - ISO/IEC 42001, published in December 2023, applies to organizations that develop, provide or use AI-based products and services.

The bottom line: - Singahi is betting that free, audit-oriented guides will help companies move faster on certification while creating a pipeline for paid implementation work.