Comparing ISO 27001:2013 and ISO 27001:2005
March 15, 2014
5 min read
Vinastar Consulting
View larger
ISO 27001:2013 was published in October 2013, replacing the 2005 edition. This is an important transition that organizations applying the older version need to complete.
Key changes
- Structure aligned to Annex SL (High Level Structure) — consistent with other ISO management system standards
- 14 clauses instead of 11 in the previous version
- Annex A reduced from 133 to 114 controls, organized into 35 control objectives
- Greater focus on leadership and commitment (Clause 5)
- Clearer emphasis on risk assessment and risk treatment
Organizations certified to ISO 27001:2005 need to transition to the 2013 (and now 2022) version to maintain certification validity.
