ISO 27001 in 2026: what has really changed and what you still need to get certified

By Kike Gandia · Research · 14 min read

Illustration of a shield with an orange check mark, four columns of cells of different heights representing the four control themes, a checklist with green, amber and red marks, and a timeline with four milestones

Every year someone asks about “the new ISO 27001”. In 2026 the question has a short answer that almost nobody gives: there is no ISO 27001:2026. The standard you certify against today is ISO/IEC 27001:2022, with Amendment 1 of 2024 on climate change. Anyone selling you an “upgrade to the 2026 version” is selling you snake oil.

That doesn't mean nothing has changed. Certificates issued against the 2013 version stopped being valid on October 31, 2025; the climate amendment is now part of the standard being audited; in July 2026 a new ISO/IEC 27000 was published that clarifies how Annex A is meant to be used; and the privacy standard ISO/IEC 27701 no longer depends on 27001. It's all here, with the level of detail an auditor expects, and at the end there's a test to find out what you're missing.

The version in force. ISO/IEC 27001:2022 + Amendment 1:2024 (Climate action changes). This is what every certification body audits against in 2026, with 93 controls in Annex A.

0: new editions of ISO 27001 in 2026 (the 2022 edition applies)
93: controls in Annex A (down from 114)
11: new controls since 2022 (threat intelligence, cloud, DLP…)
10/31/2025: 2013 certificates expired (no extension)

The timeline: what happened and when

October 2022 — ISO/IEC 27001:2022 is published
Third edition. It reorganizes Annex A from 114 to 93 controls in four themes, adds 11 controls and tweaks clauses 4 to 10 to align them with the harmonized structure shared by management system standards.
February 2024 — Amendment 1: climate change
Two new sentences in clauses 4.1 and 4.2. It doesn't change the controls or require recertification, but since then it has been part of what gets audited.
October 31, 2025 — End of the transition from 2013
ISO/IEC 27001:2013 certificates expired or were withdrawn. Organizations that didn't transition start over as new clients, with a full initial audit.
October 2025 — ISO/IEC 27701:2025 goes standalone
The privacy management standard is no longer an extension of 27001 and can be certified on its own. Holders of 27701:2019 certificates have three years to adapt.
July 3, 2026 — New ISO/IEC 27000:2026
Sixth edition of the document that introduces the family. It gets a new title, stops being a vocabulary and clarifies what Annex A is for.
Today — Certification is against 2022 + the 2024 amendment
There is no 2026 version of ISO 27001. Any project you start now is done against the 2022 edition with its amendment.

ISO 27001 is revised in cycles several years long. What changes between editions mostly arrives through amendments and the standards around it.

The climate amendment: two sentences that get audited

Amendment 1:2024 is not specific to ISO 27001: it was rolled out simultaneously across ISO's management system standards, as part of the organization's commitment to climate action. In 27001 it comes down to two sentences, but they are two sentences the auditor will ask about.

Clause 4.1 context of the organization

Added: “The organization shall determine whether climate change is a relevant issue.”
It's a “shall”: you have to make the call and be able to show it.
The answer may be yes (data centers, continuity, supply chain) or no, with a justification.

Clause 4.2 interested parties

A note is added: “Relevant interested parties can have requirements related to climate change.”
It's a note: it gives guidance, but adds no requirement of its own.
Customers, insurers or your own management may have such requirements: it's worth reviewing them.

It doesn't require new controls or recertification. It requires you to think it through and put it in writing.

In practice, a single entry in your context analysis is enough, stating whether climate change affects your information security and why: physical risks to facilities or suppliers, heat waves and data center cooling, flooding, reliance on a cloud provider in an exposed region. If it is relevant, it goes into the risk assessment like any other risk. If it isn't, two lines of justification will do.

Clauses 4 to 10: what changed in 2022

The clauses are what makes a management system work, and they're where most certifications are lost. The 2022 changes are small in wording but they change what you have to show.

Clause	What changed	What you need to be able to show
4.2 Interested parties	You must decide which of their requirements will be addressed through the ISMS.	A list of interested parties with their requirements and which ones the system covers.
4.4 Management system	You must identify the ISMS processes and how they interact.	A process map of the system, even a simple one.
6.2 Objectives	Objectives must be monitored and documented.	Objectives with an indicator, an owner, a deadline and follow-up.
6.3 Planning of changes	New clause: changes to the ISMS are carried out in a planned manner.	A log of changes to the system with their planning.
8.1 Operational planning	Criteria for processes and control of what is outsourced.	Operating criteria and control of externally provided processes, products and services.
9.2 Internal audit	Split into the audit program (9.2.1) and its execution (9.2.2).	Audit program and reports, with auditors independent of what they audit.
9.3 Management review	New input: changes in the needs of interested parties.	Review minutes covering every input in 9.3.2.
10 Improvement	The order is reversed: continual improvement first, then nonconformities.	A nonconformity log with cause, action and verification of effectiveness.

Annex A: from 114 to 93 controls in four themes

Annex A went from 14 domains to four themes. Of the 93 controls, 11 are new and the rest come from merging or updating the 2013 ones. The guidance for each is in ISO/IEC 27002:2022, which also adds attributes (control type, information security properties, cybersecurity concepts, operational capabilities and security domains) so you can filter controls and map them to other frameworks.

Organizational (A.5) policies, roles, suppliers, cloud, incidents, continuity	37 controls
Technological (A.8) access, malware, backups, logging, development, networks	34 controls
Physical (A.7) perimeters, physical access, equipment, storage media	14 controls
People (A.6) screening, training, remote working, event reporting	8 controls

The 93 Annex A controls of ISO/IEC 27001:2022, by theme.

The 11 new controls

A.5.7 Threat intelligence: Collecting and analyzing information about threats to support decisions. Sources reviewed with judgment are enough, as long as what you learn ends up somewhere.
A.5.23 Information security for use of cloud services: How cloud services are acquired, used, managed and exited, with defined security requirements.
A.5.30 ICT readiness for business continuity: ICT systems ready to support business continuity, with tested recovery objectives.
A.7.4 Physical security monitoring: Continuous monitoring of premises for unauthorized physical access.
A.8.9 Configuration management: Security configurations defined, documented, implemented and reviewed: baselines and change control.
A.8.10 Information deletion: Deleting information once it is no longer needed, across systems, devices and suppliers.
A.8.11 Data masking: Masking data in line with the access control policy, for example in test environments.
A.8.12 Data leakage prevention: Measures against leakage of sensitive information across systems, networks and devices.
A.8.16 Monitoring activities: Monitoring networks, systems and applications to detect anomalous behavior and act on it.
A.8.23 Web filtering: Managing access to external websites to reduce exposure to malicious content.
A.8.28 Secure coding: Secure development principles applied to in-house software, including software you commission from third parties.

If these eleven don't appear in your Statement of Applicability, it was built on the 2013 version.

ISO/IEC 27000:2026: what actually is new this year

It's the only document in the core of the family published in 2026, and it's probably where the confusion about an “ISO 27001:2026” comes from. ISO/IEC 27000 is not certifiable: it introduces the family of management system standards and explains how they relate to each other. Its sixth edition was published on July 3, 2026 and replaces the 2018 edition.

Title Cybersecurity and privacy, for the first time: Its new title is “Information security, cybersecurity and privacy protection — Information security management systems — Overview”. It is no longer called “Overview and vocabulary”.
Terms From 77 definitions to 12: It stops being the family's vocabulary and keeps only the terms it needs to explain its concepts. It shrinks from 27 to 11 pages.
Annex A A checklist, not a catalog: It clarifies that Annex A is there to verify you haven't overlooked any necessary control, not to pick controls from. Your controls come from your risks.

Why the Annex A point matters. It's the most common mistake in implementations: opening Annex A and working through it control by control as if it were a shopping list. The standard asks for the opposite: assess risks, decide on treatment and then compare against Annex A to make sure nothing is missing. The Statement of Applicability is the outcome of that comparison.

ISO/IEC 27701:2025: privacy goes its own way

Published in October 2025, the new ISO/IEC 27701 is no longer an extension of 27001: it has its own management system clauses and can be certified without holding 27001. It remains aligned with 27001:2022 and 27002:2022 and extends its guidance to cloud, AI-based processing, IoT, biometrics and health data. If you held 27701:2019 as an extension of your ISMS, you have a three-year transition period.

If your certificate was from 2013

It's no longer valid. The transition ended on October 31, 2025. An ISO/IEC 27001:2013 certificate expired that day or was withdrawn, and it cannot be presented as current in a tender, a supplier questionnaire or a due diligence process. To get it back you have to start as a new client, with a full initial audit against the 2022 version.

Test: what are you missing to get certified?

Twelve questions, one for each requirement an auditor checks, in the order of the standard. Answer based on what you can show, not on what you believe exists: in an audit, anything without evidence doesn't exist. At the end you'll see your readiness by section and a list of what's missing, ranked by what would stop your certification first.

Interactive readiness test for ISO/IEC 27001:2022 certification with Amendment 1:2024. Twelve questions in the order of the standard, each with the evidence the auditor asks for: ISMS scope (clause 4.3); context, interested parties and the decision on climate change (4.1 and 4.2); management commitment, policy and roles (5.1 to 5.3); risk assessment methodology and execution (6.1.2); treatment plan and Statement of Applicability against the 93 controls (6.1.3); measurable objectives and planning of changes (6.2 and 6.3); competence and awareness (7.2 and 7.3); documented information (7.5); operation of controls and supplier control (8.1 to 8.3); the 11 new Annex A controls from 2022; measurement and internal audit (9.1 and 9.2); management review and handling of nonconformities (9.3 and 10). Each question is answered with “yes, and I can show it”, “it exists, but only partly”, “no” or “I don't know”. The result shows your readiness percentage, a breakdown by section (context and leadership, risks and controls, support and operation, evaluation and improvement) and a prioritized list of what's missing, flagging anything that blocks certification. Everything is calculated in the browser.

What the road to certification looks like

1 — Gap analysis
Where you stand against the standard, with evidence. It's the test above, but run against your actual documentation.
2 — Scope, context and risks
What's in the system, what affects you and what risks you face. Everything else flows from this.
3 — Treatment and Statement of Applicability
Which controls you apply and why, compared against the 93 in Annex A.
4 — Implement and operate
Controls up and running and generating records. The auditor wants to see a period of operation, not freshly printed documents.
5 — Internal audit and management review
Both completed before you call the certification body. Without them there is no certification.
6 — Certification audit: stage 1 and stage 2
Stage 1 reviews the documentation and whether you are ready; stage 2 checks that the system really works.
7 — Annual surveillance and recertification
The certificate lasts three years, with surveillance audits every year and recertification in the third.

ISO 27001, ENS, NIS2 and DORA: what each one covers

ISO 27001 is voluntary and certifiable, and it serves as the foundation for almost everything else, but it doesn't replace any legal obligation. Each framework has its own scope, and a single well-built ISMS saves you from duplicating work.

Framework	What it is	Who it applies to	What having ISO 27001 gives you
ISO/IEC 27001	Voluntary, certifiable international standard	Anyone who wants to demonstrate an information security management system	It's the foundation: risks, controls, auditing and continual improvement
ENS	Spain's National Security Framework (Esquema Nacional de Seguridad, Royal Decree 311/2022)	The Spanish public sector and its technology suppliers	Many of the measures overlap; ENS certification is separate
NIS2	Directive (EU) 2022/2555	Essential and important entities in critical sectors	Covers much of the risk management; there are specific obligations such as incident reporting
DORA	Regulation (EU) 2022/2554, applicable since January 2025	Financial entities and their critical ICT third-party providers	A solid foundation; DORA also requires resilience testing and ICT third-party risk management

If you're torn between ENS and ISO 27001, we compare them in ISO 27001 vs ENS.

The mistakes we see most often

Order Starting with the policies: Writing twenty policies before knowing what the risks are. You start with scope and risks; the policies follow from there.
SoA A copy-pasted Statement of Applicability: A template with everything marked “applicable” and the same justification throughout. The auditor will ask for the link to your risks.
2013 Documentation from the previous version: References to 114 controls or to domains that no longer exist. An immediate sign that the system hasn't been reviewed.
Paper Controls nobody checks: The control exists in the procedure, but nobody verifies that it works. It's exactly what we see in the breach simulator.
Internal Internal audit done by whoever implemented the system: The internal audit has to be objective and impartial. Whoever designed the system cannot audit it.
Third parties Suppliers off the radar: Outsourced cloud, development or support are part of your system too. They need to be controlled through contracts and monitoring.

If you want to put numbers on your project, start with the ISO 27001 scoping form and see how much certification costs. And if you're wondering whether the standard requires technical testing, we explain it in do I need a pentest for ISO 27001?. For the whole process, end to end, there's our ISO 27001 implementation and certification service.

Topics

#ISO-27001 #ISO-27002 #ISO-27000 #ISO-27701 #ISMS #Statement-of-Applicability #Internal-audit #Compliance #Test

Keep reading

Sources

Talk to us about your ISO 27001 project