reconn is a PECB Authorized Titanium Partner

orbit by reconn.Quick answers on ISO 27001 and information security

What is the version history of ISO 27001?

Three editions, one British ancestor and one amendment. Here is the timeline and what changed each time.

  • By Shenoy
  • Updated

Every great mission starts with reconn.

ISO/IEC 27001 has had three editions: 2005, 2013 and 2022. It grew out of BS 7799, a British standard that BSI first published in 1995. The current edition is ISO/IEC 27001:2022, which was amended in 2024 for climate action changes. Certificates issued against the 2013 edition had to move to the 2022 edition by 31 October 2025.

If you see a year after the standard's name, it tells you which edition is meant. Only one edition is current at a time.

ISO 27001 version history, from BS 7799 to the 2022 edition
Year Document What it was
1995 BS 7799-1 BSI's code of practice for information security management, published in February 1995
1998 BS 7799-2 The specification for an information security management system, the part organizations were certified against
2000 ISO/IEC 17799:2000 BS 7799 Part 1 adopted as an international code of practice. It was later renumbered ISO/IEC 27002
2005 ISO/IEC 27001:2005 Edition 1, published in October 2005. The first international requirements standard for an ISMS, based on BS 7799-2
2013 ISO/IEC 27001:2013 Edition 2. Rewritten around the clause structure shared by ISO management system standards, with 114 controls in Annex A
2022 ISO/IEC 27001:2022 Edition 3, published in October 2022, and the current edition. Annex A now has 93 controls in four themes
2024 ISO/IEC 27001:2022/Amd 1:2024 A short amendment on climate action changes, published in February 2024

From BS 7799 to ISO/IEC 27001

The standard started in the United Kingdom. BSI published BS 7799 in February 1995 as a code of practice for information security management. A second part followed, which described the management system itself and gave organizations something to be certified against.

Both parts became international standards. Part 1 became ISO/IEC 17799 and was later renumbered ISO/IEC 27002, the guidance on controls. Part 2 became ISO/IEC 27001:2005, the requirements standard that auditors certify against.

What changed in the 2013 edition

The 2013 edition rewrote the standard around the clause structure that ISO management system standards share, with clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement. That shared structure is why ISO 27001 fits alongside standards such as ISO 9001 and ISO 22301. Annex A listed 114 controls in 14 groups.

What changed in the 2022 edition

ISO/IEC 27001:2022 is edition 3, published in October 2022. The management system clauses changed only a little. The larger change is in Annex A, which was aligned with ISO/IEC 27002:2022:

  • 93 controls, down from 114, because many were merged
  • Four themes: organizational, people, physical and technological
  • 11 new controls, covering topics such as threat intelligence, cloud services, secure coding and data leakage prevention

In February 2024, ISO published Amendment 1, a short text on climate action changes that applies to the 2022 edition.

Is the 2013 edition still valid?

No. ISO has withdrawn the 2005 and 2013 editions. Accreditation bodies set a transition period for certified organizations, and certification bodies had to move all their clients to the 2022 edition by 31 October 2025. A certificate that still names ISO/IEC 27001:2013 is no longer valid.

Practitioner note: When a supplier sends you an ISO 27001 certificate, read the edition on it and check the expiry date. Then ask for the Statement of Applicability, because it shows which of the 93 controls the supplier applies.

How reconn helps

For the full picture of the current edition, read our ISO 27001 guide. If you want to work with the standard, the PECB ISO 27001 Lead Implementer and Lead Auditor courses teach you to implement and audit an ISMS, and the bundle covers both.

Source

Back to blog