ISO has published amendments to more than 30 management system standards, including ISO/IEC 27001:2022/Amd 1:2024 and ISO 22301:2019/Amd 1:2024, adding explicit climate change requirements.
What’s changed?
- Clause 4.1 now requires the organisation to determine whether climate change is a relevant issue.
- Clause 4.2 notes that relevant interested parties can have requirements related to climate change.
What does this mean in practice? For most information security management systems, this means documenting whether climate change could affect your ability to achieve the intended outcomes of the ISMS: for example through physical risks to facilities and data centres, supplier disruption or changing customer and regulatory expectations. For business continuity, the link is more direct.
Certification bodies will begin checking this at audits, so update your context and interested parties analysis at your next management review.
Source: ISO/IEC 27001:2022/Amd 1:2024 Climate action changes (ISO)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
