The requirement moved
The 2017 edition applied to ISO/IEC 27001:2013. The DIS title applies to ISO/IEC 27001:2022. Edition 3 is 50 pages, against 45 in the prior edition.
The public record proves one change beyond doubt: the guidance is re-based from ISO/IEC 27001:2013 to ISO/IEC 27001:2022. The draft text is not public, so this page separates what the record proves from what a reader should check when the text is available.
PROVED
PROVED
The clause set changed
27001:2022 added clause 6.3, Planning of changes, and restructured Annex A into 93 controls across four themes. Any guidance on applying the 2022 standard must address both.
TO CHECK
The draft's own changes
New examples, removed guidance and any new annexes cannot be confirmed from the public record. Read them in the published text, not in a summary.
The five changes that matter to a working ISMS
| Area | Prior edition, 2017 | What the 2022 requirement asks | What to do now |
|---|---|---|---|
| 6.3 | No equivalent clause. | Plan changes to the ISMS: purpose, consequences, resources, responsibilities and the effect on the system. | Use a change record, not a change log. Test it on one live change. |
| Annex A | 114 controls in 14 clauses. | 93 controls in four themes: organizational, people, physical, technological. | Rebuild the Statement of Applicability against 93, with a reason for every exclusion. |
| 4.1 | Context analysis. | Context plus a recorded decision on whether climate change is relevant. | Add the climate decision to the context record, dated. |
| 5.2 | Policy. | Policy as direction, with objectives and a commitment to continual improvement. | Check the policy a reader can find is the current, approved version. |
| 10.1 | Continual improvement. | Improvement of suitability, adequacy and effectiveness. | Show the source of each improvement and the change it produced. |
Do not infer the draft's text from this table. The table compares the published 2017 edition with the published 2022 requirement. It does not describe words in the DIS, which is not public. A clause by clause comparison of the DIS belongs in the record after publication.
What a consultant should tell a client
The requirement your certificate is judged against is ISO/IEC 27001:2022. The guidance you use to apply it is being revised. That is a reason to refresh the guidance references and the evidence trail, not a reason to pause the requirement work. The draft becomes citable when it is published, and the watch exists to tell you when that happens.