ISO27001:2022 Have You Considered the Environmental Requirement?

As we edge closer to the 31 October 2025 deadline for transitioning from ISO/IEC 27001:2013 to the 2022 version, many organisations are rightly focusing on updated controls and audit readiness.

But here’s a crucial question often overlooked:

Have you considered the environmental requirement introduced in the latest standard?

In February 2024, ISO released Amendment 1 to ISO/IEC 27001:2022. It formally integrates climate change considerations into your ISMS requirements. While this isn’t about sustainability reporting or carbon tracking, it is a pivotal shift in how we view information security resilience.

What’s Changed?

Two key clauses now require you to factor in climate risk:

Clause 4.1 – Context of the Organization:

You must evaluate whether climate change is a relevant issue for your ISMS.

Clause 4.2 – Needs and Expectations of Interested Parties:

You need to assess whether your clients, regulators, or partners have environmental or climate-related concerns that could affect information security.

This “comply or justify” approach means you must document your consideration, even if you determine climate is not relevant.

Practical Implications

If climate change is relevant to your context (e.g. physical risks to data centres, impact on energy infrastructure), you'll need to:

Include climate risks in your risk register
Update your business continuity plans
Strengthen Annex A.7.5 controls (physical/environmental security)
Discuss environmental relevance during management review
Be prepared to show evidence during your transition audit

Your ISO/IEC 27001:2022 Climate Compliance Checklist

Consider climate change in Clause 4.1
Review interested party requirements under Clause 4.2
Integrate climate-related risks and mitigations
Review fire/flood/electrical risk under Annex A
Prepare documentation for external audit

Final Thoughts

You don’t need to be a climate expert to comply. But you do need to treat climate change like any other risk, evaluate it, record your position, and take steps if needed.

At Cybergen, we help organisations not only prepare for the ISO/IEC 27001:2022 transition but navigate emerging requirements like this with confidence.