The requirement moved
The 2016 edition served ISO/IEC 27001:2013, clause 9.1. The DIS is Edition 3, under the 2022 family. The current requirement text is clause 9.1 of ISO/IEC 27001:2022.
The public record proves one change beyond doubt: the guidance is re-based from the 2013 requirement to the 2022 requirement. The draft text is not public, so its own new wording, examples and annexes cannot be confirmed from the record.
PROVED
PROVED
The edition and page count changed
ISO records Edition 3 at 66 pages. The 2016 edition is the second edition. The stage history runs from a new project in 2024 to close of voting in 2026.
NOT PROVED
The draft's own changes
New examples, removed guidance, new annexes and any transition text cannot be confirmed from the public record. Read them in the published text, not in a summary.
What to check when the new edition publishes
| Area | 2016 guidance | What the 2022 requirement asks | What to do now |
|---|---|---|---|
| 9.1 | Six determinations for monitoring and measurement, plus retained results. | Evaluate security performance and management system effectiveness, with methods that give valid results. | Write the six answers as a table and keep the results. Do not wait for the revision. |
| 6.3 | The 2016 guidance has no clause 6.3, Planning of changes. | Plan changes to the management system, including purpose, consequences, resources and responsibilities. | Test a change record on one live change. A measurement method change belongs in it. |
| Annex A | The 2016 guidance has a measurement model, not a control set. | The 2022 Annex A has 93 controls in four themes. | Keep the measurement model. Map a measure to a 2022 control by name, not by the old numbering. |
| 4.1 | The 2016 guidance does not address context or climate. | Context includes a recorded decision on whether climate change is relevant. | Record the decision. It may affect the risks a measure is meant to watch. |
| 10.1 | Improvement actions can be measured by timeliness and effect. | Improve the suitability, adequacy and effectiveness of the management system. | Show the source of each improvement and the change it produced. |
Do not infer the draft's text from this table. The table compares the published 2016 guidance with the published 2022 requirement. It does not describe words in the DIS, which is not public. A clause by clause comparison belongs in the record after publication.
What a consultant should tell a client
The requirement your certificate is judged against is ISO/IEC 27001:2022, clause 9.1. The guidance you use to apply it is being revised. That is a reason to refresh the measurement register and the evidence trail, not a reason to pause the requirement work. The draft becomes citable when it is published, and the watch exists to tell you when that happens.