ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS), defining how an organization plans, runs, audits, and improves its security program. The current edition is 27001:2022, published 25 October 2022. Certification is performed by an accredited body and renewed on a three-year cycle with annual surveillance audits.
What changed in the 2022 revision?
The 2022 revision kept the clauses but rewrote Annex A around ISO/IEC 27002:2022, cutting the count from 114 controls to 93 across four themes.
The 93 controls are organized under four themes: Organizational, People, Physical, and Technological. Eleven controls are new (threat intelligence, cloud security, ICT readiness for business continuity, secure coding, and others), 24 are merged, and 58 are updated (ISO).
When did the 2013 transition deadline land?
Existing 27001:2013 certificates had to migrate to 27001:2022 by 31 October 2025, a deadline set by IAF MD 26 and enforced by accredited bodies.
After that date, an accredited body cannot issue or surveil a 2013-version certificate (IAF). Most teams we see who missed it ended up doing a full recertification audit instead of a delta gap, which is the worse path on cost and timeline.
Why is ISO 27001 the default ask in non-US security reviews?
European and Asian buyers default to ISO 27001 the way US buyers default to SOC 2, so any vendor selling globally usually carries both certificates.
The 27001 certificate also acts as the spine for the privacy and cloud extensions: ISO 27017 layers on cloud controls, ISO 27018 adds PII-processor obligations, and ISO 27701 extends the ISMS into a certifiable Privacy Information Management System. A clean 27001 audit cuts the prep cost on each of those and on the SOC 2 parallel ask.
Related terms
These adjacent terms place ISO 27001 inside the 27000 family, its cloud and privacy extensions, and the vendor-risk artifacts buyers ask for next.
- ISO 27017 - the cloud-services control extension that sits on top of 27001 Annex A
- ISO 27018 - the public-cloud PII-processor code of practice
- ISO 27701 - the certifiable PIMS extension aligned to GDPR
- ISO 42001 - the AI management-system standard that borrows 27001's clause structure
- TPRM - the vendor-review motion in which a 27001 certificate is exchanged