Is there an ISO 27001:2027? What has actually changed

The question comes up in different forms. A managing director asks whether the certificate will be worthless next year. A consultant offers a “gap analysis for the new ISO 27001”. A colleague has read a post about “ISO 27001 2026” and wants to know what has to change. There is no ISO 27001:2027, and no new edition is being drafted. The confusion has three sources, and a few things have changed since 2022 that are worth acting on.

Key takeaways

• ISO/IEC 27001:2022 is the current edition. ISO lists it as published, with no successor in development.
• One amendment exists: Amd 1:2024 added climate change to clauses 4.1 and 4.2. Auditors check it.
• ISO/IEC 27000:2026 is new, published on 3 July 2026. It is the overview and vocabulary standard, not a certification standard.
• Your 27001:2022 certificate is not affected by 27000:2026.
• Certificates against the 2013 edition expired on 31 October 2025. If yours has not moved, that is the urgent issue.
• A systematic review of 27001:2022 is due by 2027. That is a decision about whether to revise, not a new standard.

Where the confusion comes from

Three things happened close together, and they are easy to mix up.

First, in February 2024 ISO published an amendment to ISO/IEC 27001:2022 that added two sentences about climate change. Some people read “2024” and assumed a new edition.

Second, on 3 July 2026 ISO and IEC published the sixth edition of ISO/IEC 27000, the standard that gives an overview of the whole family and defines its terms. The European version, EN ISO/IEC 27000:2026, followed on 15 July. Posts about “ISO 27001 2026” almost always mean this one.

Third, ISO reviews every standard at least every five years. ISO/IEC 27001:2022 was published in October 2022, so its systematic review is due by 2027. A review can confirm the standard, revise it or withdraw it. Until ISO decides to revise it and a new edition actually goes through drafting, there is nothing to implement.

What is current, at a glance

The climate amendment: small text, real audit question

Amendment 1:2024 adds one requirement and one note. In clause 4.1, the organisation shall determine whether climate change is a relevant issue. In clause 4.2, a note says that relevant interested parties can have requirements related to climate change.

That does not turn your ISMS into an environmental management system. It means your context analysis has to show that you considered climate change and reached a conclusion. For a software company, that might be a short assessment of risks to data centres and offices from heat, floods or power outages, linked to existing continuity controls. Certification bodies have checked this since 2024. A context analysis that does not mention climate at all is an easy finding to avoid.

ISO/IEC 27000:2026: what changed and what it means for you

ISO/IEC 27000 is the entry point of the family. It describes what an ISMS is and defines the terms the other standards use. The 2026 edition has a new title, “Information security, cybersecurity and privacy protection”, which brings cybersecurity and privacy into the title for the first time. Shared terms now sit in an annex, so individual standards can update their own definitions without a full revision of 27000. The edition also places more emphasis on authenticity, accountability and non-repudiation alongside confidentiality, integrity and availability, and aligns its view of risk more closely with ISO 31000.

None of that creates a new requirement for certified companies. ISO/IEC 27000 cannot be certified, and certification bodies point out that it does not affect the validity of an existing ISO/IEC 27001 certificate. ISO/IEC 27001 and 27002 are expected to align with the new vocabulary over time, without a fixed date.

What we would do now

1. Check that you are on the 2022 edition. Certificates against the 2013 edition expired on 31 October 2025. If your SoA still uses the old Annex A numbering, start there.
2. Close the climate gap. Add a documented climate assessment to your context analysis and interested parties, and link it to continuity controls.
3. Ignore offers for a “new ISO 27001” gap analysis. There is no new edition to analyse against.
4. Update your terminology when it suits you. Aligning ISMS documents with ISO/IEC 27000:2026 is good housekeeping, not an audit requirement.
5. Watch the systematic review. If ISO decides to revise 27001, there will be drafts, public enquiry stages and a transition period. The last transition, from 2013 to 2022, gave companies three years.
6. Build your ISMS so that change is cheap. If controls, risks and evidence are linked rather than copied into documents, a future revision is an update to a mapping, not a new project.

If you are building or refreshing your Statement of Applicability, our guide on the ISO 27001 Statement of Applicability walks through it with an example.