ISO 27001:2013 update explained: What's new and why it matters

Every few years, ISO standards get a refresh — and for good reason. As technology evolves, so do the risks. The 2013 update to ISO/IEC 27001 was a significant step forward from its 2005 version, aiming to make the standard more flexible, risk-focused, and aligned with other ISO management system standards.

One of the key differences? The number of control domains was reduced from 11 to 14, and the total controls were reorganized to 114, down from 133. Some outdated controls were removed, while new ones were added to address emerging threats like mobile devices and supplier risk.

In short, the 2013 revision made ISO 27001 easier to integrate, more relevant to modern businesses, and better structured for ongoing improvement.

In 2022, the standard was updated again to reflect newer challenges and priorities. Organizations currently certified under the 2013 version must transition to the 2022 version by October 2025, after which the 2013 version will no longer be valid.

In this blog, we'll take a closer look at what changed in the 2013 revision and why it mattered at the time.

What is ISO 27001?

ISO/IEC 27001 is a globally recognized standard for managing information security. First published in 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it sets out the requirements for building, maintaining, and continuously improving an Information Security Management System (ISMS). This system is a structured framework of policies, processes, and controls designed to protect sensitive data.

At its core, ISO 27001 helps organizations identify security risks, put appropriate safeguards in place, and ensure that information stays confidential, accurate, and available, whether it is on paper, in the cloud, or anywhere in between.

Importance of ISO 27001 in cybersecurity

ISO 27001 brings structure and clarity to how an organization protects its data. Instead of handling security in isolated pockets, it helps teams build a unified, risk-based system for managing sensitive information. This means fewer gaps, clearer roles, and a consistent approach to identifying and addressing security threats.

It also goes beyond just internal improvements. ISO 27001 certification acts as a signal to customers, partners, and regulators that the organization takes data protection seriously and follows globally accepted best practices. This can support business growth, simplify audits, and improve trust in services or products.

Other benefits include faster incident response, better compliance with legal and regulatory requirements, improved control over third-party risks, and increased security awareness across teams. Altogether, ISO 27001 helps organizations build a strong foundation for cybersecurity without relying on guesswork or ad hoc measures.

What are the changes after ISO 27001:2013 update?

Area of changeISO 27001:2005ISO 27001:2013StructureCustom ISO structureAligned with Annex SL structureNumber of controls133 controls in 11 domains114 controls in 14 categoriesFocusMore prescriptiveMore risk-based and flexibleLeadershipNot explicitly requiredEmphasis on leadership and top management involvementDocumentation requirementsRequired documented proceduresMore flexibility in documentationRisk assessmentAsset-based risk assessmentBroader, context-driven risk approachControl objectivesTied directly to controlsSeparated from controls for clarityContinuous improvementImplied through PDCAExplicitly emphasized

Brief explanation of each change:

1. Structure

The 2013 version adopted the Annex SL structure, which made it easier to align with other ISO standards like ISO 9001 or ISO 14001.

2. Number of controls

Controls were consolidated, rewritten, or removed to better reflect current risks. The total number went down from 133 to 114, but with clearer categorization across 14 domains.

3. Focus

While the 2005 version leaned on set procedures, the 2013 version emphasized a risk-based approach, giving organizations more flexibility in implementation.

4. Leadership

Senior management involvement became a formal requirement to ensure information security is driven from the top.

5. Documentation requirements

The standard became less rigid, allowing organizations to define what documentation is necessary, as long as it supports effective security management.

6. Risk assessment

It moved beyond asset-based analysis to a more adaptable method that considers the organization's broader context and stakeholders.

7. Control objectives

Control objectives were made clearer and separated from the controls themselves, improving readability and purpose.

8. Continuous improvement

While the Plan-Do-Check-Act (PDCA) cycle was present before, the 2013 version placed more emphasis on ongoing improvement as a formal part of the ISMS lifecycle.

Did ISO 27001 become more difficult to achieve after the 2013 update?

No, achieving ISO 27001 did not become more difficult after the 2013 update.

The standard became more flexible and aligned with modern business needs. By focusing on risk-based thinking and reducing rigid documentation, it actually made implementation more practical and easier to integrate with other ISO standards.

What was the last update before ISO 27001:2013?

The last version before ISO 27001:2013 was ISO/IEC 27001:2005, which was the original release of the standard. Published in October 2005, it laid the foundation for formalizing information security management systems and replaced the earlier British Standard, BS 7799.

What is the latest update to ISO 27001 after the 2013 version?

The new update after ISO 27001:2013 is ISO/IEC 27001:2022, released in October 2022. It introduced 93 revised controls (down from 114), reorganized into four themes, and added 11 new controls covering areas like threat intelligence and cloud services.

Can organizations still be certified under ISO 27001:2013?

No, ISO 27001:2013 is no longer valid after October 31, 2025, which is the official deadline to transition to ISO 27001:2022. Certifications under the 2013 version will expire after this date.

Is ISO 27001 expected to change again in 2025? What should we know?

The ISO 27001:2013 version will no longer be valid after October 2025. Organizations currently certified under the 2013 version must transition to ISO/IEC 27001:2022 to maintain their certification.

The 2022 version places more emphasis on emerging areas of risk, including threat intelligence, cloud service security, data masking, and secure software development. It also restructures Annex A, reducing the number of controls from 114 to 93 by merging and refining them. These controls are now grouped under four clear themes: organizational, people, physical, and technological.

To comply, organizations will need to update their Statement of Applicability, revise control mappings and documentation, and address any gaps identified during the transition.

How does Scrut support a smooth transition from ISO 27001:2013 to ISO 27001:2022?

Scrut helps organizations transition from ISO 27001:2013 to 2022 seamlessly by taking the heavy lifting out of the process. Here's how:

1. Pre-mapped control library

Scrut provides 1400+ pre-mapped controls, including mappings for ISO 27001:2022. This means you can instantly see which of your existing controls align and where gaps exist.

2. Gap analysis made easy

It automatically highlights the differences between the 2013 and 2022 versions, especially around the 11 new controls and the reorganized structure, so you know exactly what needs updating.

3. Centralized evidence management

Scrut connects with your systems through 100+ integrations to collect audit-ready evidence. No more chasing teams for screenshots or manual logs.

4. Automated workflows for updates

Update policies, assign tasks, and track remediation for new control requirements through built-in workflows, keeping your team on track without email chaos.

5. Audit support built-in

Whether you're preparing for a transition audit or recertification, Scrut offers real-time monitoring, auditor-ready reports, and a Trust Vault to share documentation securely.

6. Expert-led guidance

Our compliance experts walk you through exactly what's changed, how to update your ISMS, and how to align your documentation and processes with the 2022 structure.

‍