---
title: "ISO 27001 Climate Change: 2024 Amendment"
canonical: "https://auditbadger.com/blog/climate-change-and-iso-27001-the-february-2024-amendment-nobody-told-you-about/"
last-updated: "2026-09-15"
---

# ISO 27001 Climate Change: 2024 Amendment

By Maciej • Published 2026-07-07 • 5 min read • Categories: ISO, Compliance Governance, Risk Management

Created with AI assistance. AuditBadger retains editorial control and responsibility.

**TL;DR:** Clause 4.1 gained a relevance requirement; Clause 4.2 gained a note about interested parties. Use your existing context and risk processes, support the conclusion with evidence and address relevant implications. There is no separate transition program, and a cloud-hosted service still needs to assess its dependencies.

[ISO/IEC 27001:2022 Amendment 1](https://www.iso.org/standard/88435.html), published on February 23, 2024, added a requirement to assess whether climate change is relevant to the ISMS and a note about interested parties. The practical task is to make that assessment and address relevant implications for information security.

## What actually changed

The [ISO/IAF joint communiqué](https://www.iso.org/files/live/sites/isoorg/files/standards/popular_standards/management_systems/ISO-IAF%20Joint%20Communique%20Feb%202024.pdf) identifies two additions to Clause 4. Clause 4.1 adds a requirement to determine the relevance of climate change. Clause 4.2 adds an explanatory note that interested parties may have climate-related requirements.

The distinction matters: the Clause 4.1 addition is a requirement; the Clause 4.2 addition is a note within the existing interested-party requirements. The amendment does not add Annex A controls or replace the 2022 edition.

## Why an information security standard suddenly cares about the climate

ISO coordinated climate amendments across multiple management system standards following its [London Declaration](https://www.iso.org/ClimateAction/ISO-climate-commitment). The [joint communiqué](https://www.iso.org/files/live/sites/isoorg/files/standards/popular_standards/management_systems/ISO-IAF%20Joint%20Communique%20Feb%202024.pdf) explains the common purpose: consider effects on the intended results of each management system.

You can reuse research across an integrated management system, but assess the implications for each scope. A conclusion about environmental performance does not automatically settle the implications for information security.

## The part that matters: "determine whether" — not "declare that"

The relevance assessment is mandatory; its conclusion depends on your circumstances. Climate change may be relevant to one part of your ISMS and not another. Being a small team or hosting in the cloud does not establish the answer by itself.

Keep a reasoned record of what you considered and how you reached the conclusion. A short entry in an existing context analysis can be a practical way to show the work; the amendment does not prescribe a separate climate policy or the table used below.

[IAF implementation guidance](https://iaf.nu/en/news/iaf-and-iso-publish-joint-communique/) says a full transition program is not needed and a revised certificate should not need to be issued. Certification bodies are expected to evaluate the consideration in their audits, including the process used when an organization concludes climate change is not relevant.

## Is climate change actually relevant to an ISMS?

Use information security consequences to guide the assessment. The following are illustrative prompts, not findings about your organization:

- **Service availability:** could heat, flooding or power disruption affect hosting, offices, connectivity or recovery arrangements?
- **Supplier dependencies:** what do your hosting and connectivity providers say about relevant locations, resilience and service dependencies?
- **People and operations:** could a regional disruption affect the people needed to operate the service or restore it?
- **Interested parties:** are there actual customer, contractual or regulatory requirements relevant to the ISMS?

Connect any relevant issue to your existing risk assessment and applicable [Annex A controls](/blog/iso-27001-annex-a-controls-the-complete-2022-guide/). A sustainability request needs to be evaluated in context; it does not automatically require a new information security control.

## What to actually do (it's an hour or two, honestly)

Use the context and risk processes you already maintain. The work needed depends on your locations, dependencies and available evidence.

1. **Identify the scope.** Include the service, locations, suppliers and operational dependencies relevant to your ISMS.
2. **Assess relevance.** Record the climate-related issues considered, evidence reviewed and conclusion.
3. **Check interested parties.** Identify actual requirements and decide how the ISMS addresses those that are relevant.
4. **Follow through.** Link relevant issues to risk decisions, actions and owners, then revisit them when the context changes.

## Example climate assessment record for a SaaS company

This is a fictional worked example, not a claim about AuditBadger or a customer. Adapt the fields to evidence your team has actually reviewed; do not copy the conclusion without doing the assessment.

| Field | Illustrative entry |
| --- | --- |
| Scope | A hosted customer application, its recovery environment and the people who operate it. |
| Issue considered | A regional weather event could disrupt the primary hosting location and connectivity used by the response team. |
| Evidence reviewed | Hosting location information, supplier resilience documentation, the recovery design and the latest recovery exercise record. |
| Relevance decision | Relevant to availability: recovery depends on a second location whose independence needs confirmation. |
| Interested-party requirement | The customer's actual availability and recovery commitments, referenced to the signed agreement. |
| Action and owner | The service owner confirms location dependencies and records the outcome of a recovery exercise in the risk register. |
| Review trigger | A hosting change, new supplier information, a relevant incident or a change in customer commitments. |

To use this format, replace the illustrative entries with your scope, evidence references, assessment date and named owner. Record unresolved questions as actions rather than presenting assumptions as completed checks.

### What if the conclusion is not relevant?

Explain why the evidence supports that conclusion for the scope examined. Identify dependencies and requirements considered, and what would cause a reassessment. A control that reduces a relevant risk is not the same as evidence that the issue is irrelevant.

## What auditors will ask for

[IAF guidance for certification bodies](https://iaf.nu/en/news/iaf-and-iso-publish-joint-communique/) focuses on whether climate change was considered and whether relevant issues were addressed. It also calls for evaluating the determination process when an organization concludes the issue is not relevant.

A practical evidence trail connects the context assessment, interested-party requirements, related risk decisions and the records showing follow-up. Keep it within your existing [ISMS documentation](/blog/introducing-the-isms-workbook-the-iso-27001-requirements-nobody-told-you-about/) and include it in your [internal audit review](/blog/iso-27001-internal-audit-step-by-step-guide/). You can also use the [ISO 27001 overview](/iso27001/) to place this work within the wider ISMS.

Check that the conclusion is supported by the evidence, not just that a document mentions climate change. This record helps an auditor follow your reasoning; it does not guarantee a particular audit outcome.

## The bottom line

Amendment 1:2024 asks you to assess climate change in the context of your management system. Make the conclusion specific, connect relevant issues to action and keep the evidence current. The example above gives you a place to start without inventing a separate compliance program.


## Frequently asked questions

### Does the ISO 27001 climate change amendment require recertification?

The amendment does not trigger a separate certification transition program. IAF says a revised certificate should not need to be issued, while certification bodies should include the climate consideration in their audits; the normal surveillance and recertification cycle still applies.

### What exactly did Amendment 1:2024 change in ISO 27001?

Amendment 1:2024 adds a requirement in Clause 4.1 to determine whether climate change is relevant to the ISMS. It also adds a note in Clause 4.2 about climate-related requirements of interested parties; it does not add Annex A controls or create a new edition.

### Can we conclude that climate change is not relevant to our ISMS?

Yes, if a reasoned assessment supports that conclusion for your ISMS scope. Being small or cloud-hosted is not sufficient by itself: consider the relevant dependencies and interested-party requirements, retain evidence of the reasoning and revisit it when circumstances change.

### Which other ISO standards received the 2024 climate change amendment?

The coordinated changes covered multiple management system standards, including ISO 9001, ISO 14001, ISO 22301 and ISO 45001 alongside ISO/IEC 27001. Research can be shared across an integrated system, but relevance and implications need to be assessed for each management system scope.

### What evidence do auditors expect for the ISO 27001 climate change requirement?

Keep an evidence trail showing what was considered, the relevance conclusion and any related interested-party requirements. Where issues are relevant, connect them to risk decisions and follow-up; the example table in this article is a practical format, not a prescribed ISO document or a guarantee of an audit outcome.