Part I · Chapter 1 · The Ask · lesson 8
Everything here has a year on it, including this
9 min
Part I · Chapter 1 · The Ask · lesson 8
9 min
A blog post explains exactly what you need to do and tells you to look up A.9.2.5. You open the standard you have just bought and that identifier is not in it. Not moved, not renamed — the whole A.9 section is gone, and the document you are holding stops at A.8.
Nothing is wrong with the blog post. It was written in 2019 and the document was restructured in 2022, and nobody updates a blog post.
Predict
Three places the year lives, and they are not the same year.
The edition of the standard. ISO/IEC 27001 is currently in its 2022 revision, which superseded the 2013 one. The annex was reorganised into four themes and everything in it was renumbered, so a pre-2022 identifier will not resolve.
The edition of the criteria. The trust services criteria in current use are the 2017 set. The criteria themselves have not been renumbered since; the supporting material underneath them was revised more recently, which means two documents can cite the same identifier and mean slightly different guidance.
The date on the thing you are holding. A report covers a period with two dates. A certificate names an edition and an expiry. A guide names neither and is therefore the least trustworthy object in the pile.
Two numbers are worth carrying, and neither of them is about the content.
The 2013 annex held 114 controls across fourteen clauses. The 2022 annex holds 93, grouped into four themes. Nothing was deleted on the grounds of being unnecessary — most of the reduction is consolidation, where several related controls became one — and eleven identifiers in the new annex have no predecessor in the old one.
The consequence for a reader is mechanical and annoying. Any crosswalk, blog post, template, consultant's spreadsheet or internal register written before 2022 cites identifiers that no longer resolve, and a register in that state is not wrong about security while being unusable as a reference. Organisations that held the 2013 certificate had a transition deadline of the 31st of October 2025 to move across, so by the time you read this the old edition is behind the market as well as behind the publisher.
None of which tells you anything about what the clauses say. The identifiers are pointers. The habit is to check which edition you are pointing into.
Check
Because the artefacts have three independent clocks and nobody synchronises them.
The standards are revised on their own cycle, by committee, with transition windows measured in years. The professional rules governing who may say what, and in what form, move on a second cycle. And the market's expectations — how long a period buyers want, whether they will take a letter covering a gap, what a questionnaire looks like — move on a third, much faster, driven by whichever large buyer last had a bad experience.
Content about this subject usually states none of the three. A guide will tell you what to do without saying which edition it was written against, which rules were in force, or what buyers were asking for that year. Each omission is small and the compound effect is a body of advice that is confidently wrong in a way nobody can date.
Which is why every lesson here carries a visible date, and why the honest answer to most questions in this field begins with a year.