ISO/IEC 27001:2013

Why does it matter?

Documents, supplier answers and certificates written before October 2022 refer to this edition. Reading them correctly means knowing what the 2013 clauses and Annex A said and how the 2022 edition changed them, so that an ISMS built on the old text can be carried over without starting again.

Key benefits include:

• Know what a 2013 reference means

The 2013 edition ends with Annex A, which lists reference control objectives and controls; the 2022 edition replaced it with a list of information security controls drawn from ISO/IEC 27002:2022.

• Compare the two numbering schemes

The 2022 edition adds Clause 6.3 and Clause 4.2 c), swaps the order of the two subclauses in Clause 10 and renames and reorders subclauses in Clauses 9.2 and 9.3 (IAF MD 26:2023, section 2.2).

• Understand the transition

The transition period ended on October 31, 2025, so 2013-based certifications were to have expired or been withdrawn by then.

• Reuse the existing ISMS

IAF states that the impact of the 2022 edition on organizations that already run an ISMS need not be significant (IAF MD 26:2023, section 2.3).

• Keep the decision record

The Statement of Applicability under Clause 6.1.3 d) is the document to carry forward and update against the 2022 control set.

How does it work?

The 2013 edition follows the structure used by the ISO management system standards: context of the organization (Clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Clause 3 takes its terms from ISO/IEC 27000, which Clause 2 lists as an undated normative reference.

Risk work sits in Clause 6.1. The organization defines a risk assessment process with risk acceptance criteria and criteria for performing assessments, produces consistent and comparable results (6.1.2), selects risk treatment options, determines the necessary controls, compares them with Annex A to confirm none is omitted, produces the Statement of Applicability, formulates a risk treatment plan and obtains risk owners' approval of the plan and acceptance of residual risk (6.1.3). Clauses 8.2 and 8.3 apply the assessment and treatment during operation.

Annex A is normative. It lists control objectives and controls, and Notes to Clause 6.1.3 state that the list is not exhaustive and that additional controls can be added. The 2022 edition reduced the control set from 114 controls in 14 clauses to 93 controls in four, with 11 new controls, 24 merged and 58 updated (IAF MD 26:2023, section 2.2, Note 2).

Key Elements

• Context and leadership (Clauses 4 and 5)

Determine external and internal issues and interested parties, define the ISMS scope (4.3), and have top management set the information security policy (5.2) and assign roles (5.3).

• Risk assessment and treatment (Clause 6.1)

Risk criteria, identification, analysis and evaluation (6.1.2), then treatment options, necessary controls, comparison with Annex A, the Statement of Applicability and the treatment plan (6.1.3).

• Objectives (Clause 6.2)

Information security objectives that are consistent with the policy, measurable if practicable, communicated and updated, with a plan of what, who, when and how results are evaluated.

• Support and documented information (Clause 7)

Resources, competence, awareness, communication and the creation and control of documented information (7.5).

• Operation (Clause 8)

Operational planning and control (8.1), then information security risk assessment (8.2) and risk treatment (8.3) carried out during operation.

• Performance evaluation and improvement (Clauses 9 and 10)

Monitoring and measurement (9.1), internal audit (9.2), management review (9.3), nonconformity and corrective action (10.1) and continual improvement (10.2).

• Annex A (normative)

Reference control objectives and controls used for the comparison in Clause 6.1.3 c) and the Statement of Applicability.

What does it cover?

ISO/IEC 27001:2013 specifies requirements for establishing, implementing, maintaining and continually improving an ISMS within the context of the organization, including the assessment and treatment of information security risks tailored to the organization. The requirements are generic and intended to apply to all organizations regardless of type, size or nature, and excluding any of Clauses 4 to 10 is not acceptable when claiming conformity (Clause 1).

What are its objectives?

The Introduction states what the ISMS is for:

To preserve the confidentiality, integrity and availability of information by applying a risk management process, and to give interested parties confidence that risks are adequately managed (Clause 0.1).

To be part of and integrated with the organization's processes and management structure, with information security considered in the design of processes, systems and controls (Clause 0.1).

To be scaled to the organization's needs, objectives, processes, size and structure (Clause 0.1).

To let internal and external parties assess whether the organization can meet its own information security requirements (Clause 0.1).

Framework in Context

The 2013 edition canceled and replaced ISO/IEC 27001:2005 and was itself replaced by ISO/IEC 27001:2022, which also incorporated the 2014 and 2015 corrigenda and aligned the text with the harmonized structure for management system standards and ISO/IEC 27002:2022. ISO/IEC 27002:2013 gave the control guidance behind the 2013 Annex A, and ISO/IEC 27002:2022 now does the same for the current Annex A. ISO/IEC 27001:2022/Amd 1:2024 later added climate change considerations to Clauses 4.1 and 4.2 of the current edition, not of this one.

Common Framework Mappings

Crosswalks written against the 2013 edition use its Annex A structure of 14 clauses. Re-point them to the ISO/IEC 27001:2022 page before reusing them.

Mapped frameworks include:

CIS Critical Security Controls

FedRAMP

ISO/IEC 27002

ISO/IEC 27017

ISO/IEC 27018

ISO/IEC 27701

NIST Cybersecurity Framework

NIST SP 800-53

PCI DSS

SOC 2