The International Organization for Standardization (ISO) is expected to publish a revised version of ISO/IEC 27001 in 2026. While the exact release date is pending, draft versions indicate several important changes that organisations should begin preparing for now.
Stronger emphasis on climate change and resilience
Annex A will likely introduce new controls addressing environmental risks and business continuity in the face of climate‑related disruptions. Organisations will need to demonstrate that they have considered climate change as part of their risk assessment.
Alignment with ISO/IEC 27002:2022
The 2022 update to 27002 introduced 11 new controls and consolidated others. The 2026 revision of 27001 will formally align with these changes, including new requirements for threat intelligence, information security for cloud services, and data leakage prevention.
Greater focus on supply chain security
Expect more explicit requirements around third‑party risk management. Organisations will need to extend their ISMS to cover critical suppliers and service providers, with documented oversight and due diligence processes.
Simplified structure and clearer terminology
The revision aims to make the standard more accessible, particularly for SMEs. The core requirements (Clauses 4–10) remain largely intact, but the language is being refined for clarity.
What you should do now
1. Review your current Statement of Applicability against the 2022 version of 27002.
2. Assess how climate‑related risks might affect your information assets.
3. Strengthen your third‑party risk management programme.
4. Engage with a qualified consultant to plan a smooth transition.
Shortech Consulting provides ISO 27001 readiness and transition support. Contact us to discuss how the 2026 update affects your organisation.