Amendment 1 to ISO/IEC 27001:2022, published in February 2024, adds one requirement and one note. Clause 4.1 now requires the organisation to determine whether climate change is a relevant issue for the ISMS; clause 4.2 gains a note that interested parties can have requirements related to climate change. The same text was added to every ISO management system standard that follows the harmonised structure. Nothing else changed: no Annex A control, no new documented information, no transition period and no new certificate. Auditors check that the consideration was made and recorded, and, where climate change was found relevant, that it reached the risk assessment.
Amendment 1 generated more commentary than text. The change is two sentences, the result of a joint ISO and IAF decision in 2024 to add climate change to the harmonised structure used by all management system standards, from quality to information security. Here is what it says, what it does not say, and what an auditor looks for.
Exactly what changed
| Clause | Before | After Amendment 1 | Kind of change |
|---|---|---|---|
| 4.1 Understanding the organization and its context | Determine the external and internal issues relevant to the ISMS's purpose and intended outcomes | Adds: the organisation shall determine whether climate change is a relevant issue | A new requirement, one sentence |
| 4.2 Understanding the needs and expectations of interested parties | Determine interested parties, their relevant requirements, and which will be addressed through the ISMS | Adds a note: relevant interested parties can have requirements related to climate change | A note, which is guidance and not a requirement |
| Clauses 5 to 10 | Unchanged | Unchanged | None |
| Annex A | 93 controls | 93 controls, unchanged | None |
What it does not require
- No climate risk assessment as a separate exercise, and no new documented information beyond the record of the clause 4.1 decision.
- No new control, no change to the Statement of Applicability unless the risk assessment changes.
- No transition audit, no new certificate and no reissue of existing certificates; the amended text was audited at the next regular visit.
- No sustainability reporting. The amendment is about whether climate change affects the ISMS's ability to achieve its outcomes, not about the organisation's emissions.
How to record the consideration
Add a line to the context register that clause 4.1 already requires: the question, the answer, and the reasoning. A cloud-hosted software company without owned facilities might record that climate change is not a relevant issue for the ISMS because the physical and environmental risks sit with its providers, whose certifications and continuity arrangements are assessed under A.5.23 and A.5.19, and that the decision is reviewed with the rest of the context. A company with its own data centre, offices in flood-prone areas, field equipment or weather-dependent operations would answer yes and carry the issue into the risk assessment. Either answer satisfies the clause when it is reasoned and dated. The checklist places this with the other clause 4 items.
Where climate change is relevant
The information security angle is almost always availability. Flooding, extreme heat, storms, wildfire and the power and connectivity failures they cause threaten sites, equipment and the people who run them, and the same threats at providers propagate through the supply chain. The relevant controls already exist: A.5.29 and A.5.30 for continuity and ICT readiness, A.7.5 for protection against physical and environmental threats, A.8.14 for redundancy, A.8.13 for backup, and A.5.19 to A.5.23 for the providers you depend on. The amendment changes none of them; it asks whether your risk assessment considered the cause. Interested parties can also bring requirements, which is what the clause 4.2 note points at: a customer's resilience questionnaire, a regulator's expectations for critical infrastructure, or an insurer's conditions.
What auditors ask
- Where is the clause 4.1 determination recorded, and when was it made?
- If climate change was found relevant, where does it appear in the risk assessment and which treatments followed?
- If it was found not relevant, what is the reasoning, and were provider dependencies considered?
- Have interested parties raised climate-related requirements, and are they in the clause 4.2 register?
Certification bodies audit the amended text as part of the normal clause 4 review. A missing determination is a minor nonconformity at most; a determination that says 'not relevant' for an organisation that runs its own data centre in a flood zone will be questioned. The surveillance guide covers what each visit reviews.