ISO 27001 in 2026 – Is Your Information Security System Up to Date?
With ISO 9001 and ISO 14001 both revised in 2026, many businesses are asking whether ISO 27001 has changed too. The short answer: there is no new 2026 edition of ISO 27001. But there have been important changes in the last few years, and every certified business should check it is up to date.
ISO 27001:2022 is now the only version
ISO 27001 was revised in 2022. The transition period ended on 31 October 2025, so certificates issued against the old ISO 27001:2013 have now expired. If your information security management system (ISMS) is still built around the 2013 version, it needs updating.
The main changes in ISO 27001:2022
A reorganised Annex A
The list of security controls in Annex A was cut from 114 to 93 and grouped into four themes: organisational, people, physical and technological. Many controls were merged or reworded rather than removed.
Eleven new controls
The 2022 version added controls that reflect how businesses work today, including:
- Threat intelligence
- Information security for the use of cloud services
- ICT readiness for business continuity
- Data leakage prevention, data masking and information deletion
- Configuration management, monitoring activities, web filtering and secure coding
- Physical security monitoring
Planning of changes
A new clause requires changes to your ISMS to be carried out in a planned way, whether that is new technology, a new supplier or a change in how your business is organised.
The 2024 climate change amendment
In 2024, ISO added two climate-related requirements to ISO 27001 and many other management system Standards. You must now:
- Decide whether climate change is a relevant issue for your ISMS
- Consider whether your interested parties have climate-related requirements
For information security, the link is often clearer than people expect. Floods, storms, heatwaves and supply chain disruption can all affect the availability of your systems and data. If you decide climate change is not relevant, you should still be able to explain why.
Why ISO 27001 matters more than ever
ISO 27001 remains the fastest growing ISO management system Standard. Government and larger private sector buyers increasingly expect suppliers to prove robust information security, and certification is often a requirement to get onto tenders and frameworks.
How Hawkstone can help
Whether you need to bring an existing ISMS up to date or are starting ISO 27001 from scratch, Hawkstone can help. We will:
- Review what you already have in place
- Agree a list of actions for you to implement
- Help you implement the changes
- Provide appropriate training and auditing, so you go into your audit with confidence
