Sign in

ISO 27001

ISO/IEC 27001 Information Security Management Systems — ISO/IEC JTC 1/SC 27

Also known as: ISO/IEC 27001, ISO 27001:2022, ISMS, ISO 27001:2013, ISO IEC 27001

Official site Official change log Subscribe to ISO 27001 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ISO/IEC 27001:2022/Amd 1:2024
Published 23 February 2024. source
Status
In force
Next deadline
None announced
Who must comply
Any organization, regardless of type, size or nature, that wants to establish, run and improve an information security management system (ISMS). source
How it is assessed
An independent certification body audits the ISMS and issues a certificate, then keeps it under surveillance and recertification audits. source
Authority
Published jointly by ISO and IEC (committee ISO/IEC JTC 1/SC 27). Certification bodies certify organizations; national accreditation bodies accredit those certification bodies. source source
Enforced by
A voluntary standard with no legal requirements of its own. Certificates to the replaced 2013 edition had to expire or be withdrawn by 31 October 2025. source
Last change

Internationally recognized certifiable standard for information security management systems (ISMS), used by organizations of any type and size to show a systematic approach to security.

Recent changes

  1. High
    ISO/IEC 24383:2026 FDIS sets requirements for physical network security of customer premises ICT…

    IEC has released the Final Draft International Standard (FDIS) of ISO/IEC 24383:2026, available for purchase during its voting period (2026-09-11 to 2026-10-23), with the final publication …

    New document Deadline 2026-10-23 Action required

Key dates

No upcoming dates
  1. Certification bodies must use ISO/IEC 27006-1:2024 for all ISO/IEC 27001 clients (end of the 27006-1 transition)
  2. End of the transition to ISO/IEC 27001:2022: all certifications based on ISO/IEC 27001:2013 expire or are withdrawn
  3. Certification bodies must begin initial certification and recertification to ISO/IEC 27001:2022 only, no later than this date
  4. ISO/IEC 27006-1:2024, the requirements for bodies certifying ISMS, is published
Show 1 earlier date
  1. Accreditation bodies complete the transition of certification bodies to ISO/IEC 27001:2022

Amendments

  1. ISO/IEC 27001:2022/Amd 1:2024 AmendmentCurrent text

    Amendment 1 to the 2022 edition, titled "Climate action changes". source

    More
    • Clause 4.1 adds that the organization shall determine whether climate change is a relevant issue.
    • Clause 4.2 adds a note that relevant interested parties can have requirements related to climate change.
  2. ISO/IEC 27001:2022 Major version

    Third edition; replaced ISO/IEC 27001:2013 and follows the harmonized structure for management system standards. source

    More
    • Annex A now references the information security controls of ISO/IEC 27002:2022.
    • New item 4.2 c): determine which requirements of interested parties the ISMS addresses.
    • New subclause 6.3, Planning for changes, requires changes to the ISMS to be planned.
    • The notes of 6.1.3 c) were revised and the wording of 6.1.3 d) was re-organized.
    • Subclauses of 9.2 (internal audit) and 9.3 (management review) were named and reordered.
  3. ISO/IEC 27001:2013/Cor 2:2015 Errata

    Technical Corrigendum 2 to the 2013 edition. source

    More
    • Re-organized the wording of clause 6.1.3 d) (Statement of Applicability).
  4. ISO/IEC 27001:2013/Cor 1:2014 Errata

    Technical Corrigendum 1 to the 2013 edition, related to Annex A. source

  5. ISO/IEC 27001:2013 Major version

    Second edition; withdrawn on 25 October 2022 when the 2022 edition was published. source

Show 1 older amendment
  1. ISO/IEC 27001:2005 Major version

    First edition. source

Who it applies to

Any organization that wants a certifiable ISMS. The standard is voluntary, but some regulators and public buyers require certification.

Who it is for
The requirements are generic and intended to apply to all organizations, regardless of type, size or nature. source
What it requires
Establishing, implementing, maintaining and continually improving an ISMS, including the assessment and treatment of information security risks. source
No exclusions
An organization that claims conformity may not exclude any requirement in Clauses 4 to 10. source
Legal status
ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source
Italy, public sector
To sell IT services to Italian public bodies through the central marketplace, a provider must meet the requirements of the national cybersecurity agency (ACN), one of which is ISO/IEC 27001 certification with the ISO/IEC 27017 and 27018 extensions. source
Germany, energy
Bundesnetzagentur certification schemes for energy grid operators and for energy producers are based on an ISO/IEC 27001 ISMS. source

How compliance is assessed

An independent certification body audits the ISMS and issues a certificate, then keeps it under surveillance and recertification audits.

Certification audit
A certification audit is carried out by an independent third-party certification body. source
Accreditation
Certification bodies are accredited by a national accreditation body against ISO/IEC 17021-1 and ISO/IEC 27006-1. source
Rules for certifiers
ISO/IEC 27006-1:2024 sets requirements for bodies certifying ISMS, in addition to ISO/IEC 17021-1. source
Audit cycle
A certificate runs in a certification cycle with surveillance and recertification audits; the 2022 transition audit could be combined with either one. source
How often
Not confirmed by an official source yet.
Checking a certificate
Accredited certificates from bodies accredited by IAF signatory members can be checked in the IAF CertSearch database. source

Enforcement and penalties

A voluntary standard with no legal requirements of its own. Certificates to the replaced 2013 edition had to expire or be withdrawn by 31 October 2025.

Legal force
ISO standards are voluntary and contain no contractual, legal or statutory requirements. source
Old certificates
All certifications based on ISO/IEC 27001:2013 had to expire or be withdrawn at the end of the transition period on 31 October 2025. source

Documents

  1. Standard ISO/IEC 27001:2022 (catalogue entry; paid standard)
  2. Standard ISO/IEC 27001:2022/Amd 1:2024 Climate action changes (catalogue entry)
  3. Standard ISO/IEC 27006-1:2024 Requirements for bodies certifying ISMS (catalogue entry)
  4. Guidance IAF MD 26:2023 Transition requirements for ISO/IEC 27001:2022
  5. Guidance IAF MD 29:2024 Transition requirements for ISO/IEC 27006-1:2024
Show 1 more document
  1. Guidance SC 27 Journal 2026, Issue 1: ISO/IEC 27001 certification

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 14 September 2026. Subscribe to ISO 27001 (RSS)