Every few years, ISO standards get a refresh — and for good reason. As technology evolves, so do the risks. The 2013 update to ISO/IEC 27001 was a significant step forward from its 2005 version, aiming to make the standard more flexible, risk-focused, and aligned with other ISO management system standards.
One of the key differences? The number of control domains was reduced from 11 to 14, and the total controls were reorganized to 114, down from 133. Some outdated controls were removed, while new ones were added to address emerging threats like mobile devices and supplier risk.
In short, the 2013 revision made ISO 27001 easier to integrate, more relevant to modern businesses, and better structured for ongoing improvement.
In 2022, the standard was updated again to reflect newer challenges and priorities. Organizations currently certified under the 2013 version must transition to the 2022 version by October 2025, after which the 2013 version will no longer be valid.
In this blog, we’ll take a closer look at what changed in the 2013 revision and why it mattered at the time.
What is ISO 27001?
ISO/IEC 27001 is a globally recognized standard for managing information security. First published in 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it sets out the requirements for building, maintaining, and continuously improving an Information Security Management System (ISMS). This system is a structured framework of policies, processes, and controls designed to protect sensitive data.
At its core, ISO 27001 helps organizations identify security risks, put appropriate safeguards in place, and ensure that information stays confidential, accurate, and available, whether it is on paper, in the cloud, or anywhere in between.
Importance of ISO 27001 in cybersecurity
ISO 27001 brings structure and clarity to how an organization protects its data. Instead of handling security in isolated pockets, it helps teams build a unified, risk-based system for managing sensitive information. This means fewer gaps, clearer roles, and a consistent approach to identifying and addressing security threats.
It also goes beyond just internal improvements. ISO 27001 certification acts as a signal to customers, partners, and regulators that the organization takes data protection seriously and follows globally accepted best practices. This can support business growth, simplify audits, and improve trust in services or products.
Other benefits include faster incident response, better compliance with legal and regulatory requirements, improved control over third-party risks, and increased security awareness across teams. Altogether, ISO 27001 helps organizations build a strong foundation for cybersecurity without relying on guesswork or ad hoc measures.
What are the changes after ISO 27001:2013 update?
| Area of change | ISO 27001:2005 | ISO 27001:2013 |
| Structure | Custom ISO structure | Aligned with Annex SL structure |
| Number of controls | 133 controls in 11 domains | 114 controls in 14 categories |
| Focus | More prescriptive | More risk-based and flexible |
| Leadership | Not explicitly required | Emphasis on leadership and top management involvement |
| Documentation requirements | Required documented procedures | More flexibility in documentation |
| Risk assessment | Asset-based risk assessment | Broader, context-driven risk approach |
| Control objectives | Tied directly to controls | Separated from controls for clarity |
| Continuous improvement | Implied through PDCA | Explicitly emphasized |
Brief explanation of each change:
1. Structure
The 2013 version adopted the Annex SL structure, which made it easier to align with other ISO standards like ISO 9001 or ISO 14001.
2. Number of controls
Controls were consolidated, rewritten, or removed to better reflect current risks. The total number went down from 133 to 114, but with clearer categorization across 14 domains.
3. Focus
While the 2005 version leaned on set procedures, the 2013 version emphasized a risk-based approach, giving organizations more flexibility in implementation.
4. Leadership
Senior management involvement became a formal requirement to ensure information security is driven from the top.
5. Documentation requirements
The standard became less rigid, allowing organizations to define what documentation is necessary, as long as it supports effective security management.
6. Risk assessment
It moved beyond asset-based analysis to a more adaptable method that considers the organization’s broader context and stakeholders.
7. Control objectives
Control objectives were made clearer and separated from the controls themselves, improving readability and purpose.
8. Continuous improvement
While the Plan-Do-Check-Act (PDCA) cycle was present before, the 2013 version placed more emphasis on ongoing improvement as a formal part of the ISMS lifecycle.
Did ISO 27001 become more difficult to achieve after the 2013 update?
No, achieving ISO 27001 did not become more difficult after the 2013 update.
The standard became more flexible and aligned with modern business needs. By focusing on risk-based thinking and reducing rigid documentation, it actually made implementation more practical and easier to integrate with other ISO standards.
What was the last update before ISO 27001:2013?
The last version before ISO 27001:2013 was ISO/IEC 27001:2005, which was the original release of the standard. Published in October 2005, it laid the foundation for formalizing information security management systems and replaced the earlier British Standard, BS 7799.
What is the latest update to ISO 27001 after the 2013 version?
The new update after ISO 27001:2013 is ISO/IEC 27001:2022, released in October 2022. It introduced 93 revised controls (down from 114), reorganized into four themes, and added 11 new controls covering areas like threat intelligence and cloud services.
Can organizations still be certified under ISO 27001:2013?
No, ISO 27001:2013 is no longer valid after October 31, 2025, which is the official deadline to transition to ISO 27001:2022. Certifications under the 2013 version will expire after this date.
Is ISO 27001 expected to change again in 2025? What should we know?
The ISO 27001:2013 version will no longer be valid after October 2025. Organizations currently certified under the 2013 version must transition to ISO/IEC 27001:2022 to maintain their certification.
The 2022 version places more emphasis on emerging areas of risk, including threat intelligence, cloud service security, data masking, and secure software development. It also restructures Annex A, reducing the number of controls from 114 to 93 by merging and refining them. These controls are now grouped under four clear themes: organizational, people, physical, and technological.
To comply, organizations will need to update their Statement of Applicability, revise control mappings and documentation, and address any gaps identified during the transition.
How does Scrut support a smooth transition from ISO 27001:2013 to ISO 27001:2022?
Scrut helps organizations transition from ISO 27001:2013 to 2022 seamlessly by taking the heavy lifting out of the process. Here’s how:
1. Pre-mapped control library
Scrut provides 1400+ pre-mapped controls, including mappings for ISO 27001:2022. This means you can instantly see which of your existing controls align and where gaps exist.
2. Gap analysis made easy
It automatically highlights the differences between the 2013 and 2022 versions, especially around the 11 new controls and the reorganized structure, so you know exactly what needs updating.
3. Centralized evidence management
Scrut connects with your systems through 100+ integrations to collect audit-ready evidence. No more chasing teams for screenshots or manual logs.
4. Automated workflows for updates
Update policies, assign tasks, and track remediation for new control requirements through built-in workflows, keeping your team on track without email chaos.
5. Audit support built-in
Whether you’re preparing for a transition audit or recertification, Scrut offers real-time monitoring, auditor-ready reports, and a Trust Vault to share documentation securely.
6. Expert-led guidance
Our compliance experts walk you through exactly what’s changed, how to update your ISMS, and how to align your documentation and processes with the 2022 structure.
Megha Thakkar has been weaving words and wrangling technical jargon since 2018. With a knack for simplifying cybersecurity, compliance, AI management systems, and regulatory frameworks, she makes the complex sound refreshingly clear. When she’s not crafting content, Megha is busy baking, embroidering, reading, or coaxing her plants to stay alive—because, much like her writing, her garden thrives on patience. Family always comes first in her world, keeping her grounded and inspired.
