Five-Year Review Cycles Are No Longer Enough

ISO needs to fundamentally rethink how its standards are developed, reviewed, and maintained. Artificial intelligence, cybersecurity threats, technology, and regulatory obligations are evolving almost daily and that means risk is constantly changing. Expecting organizations to rely on controls that are largely unchanged for five years or longer no longer makes sense.

ISO standards must evolve as quickly as risk does

The traditional approach to standards development is becoming outdated and archaic. While ISO management system standards provide an essential foundation for governance, risk management, and organizational accountability, the pace at which they are updated is no longer aligned with the environments they are intended to govern.

Organizations cannot be expected to manage tomorrow's risks using yesterday's controls.

Standards such as ISO/IEC 27001 and ISO/IEC 42001 must remain relevant in a world where emerging technologies, AI capabilities, cyber threats, and regulatory requirements can change significantly within months, not years.

The implications are practical. An organization may have implemented controls that were appropriate when its management system was designed, only to find that new technologies, attack methods, or regulatory expectations have exposed gaps in those controls. The organization may still be able to demonstrate conformity with the published requirements while struggling to address risks that have emerged since those requirements were developed.

This creates a challenge for both organizations and auditors. Organizations need to respond to emerging risks, but they also need clear, authoritative guidance on what good practice looks like. Auditors need a consistent basis for assessing controls, but the requirements they rely on must remain relevant to the risks those controls are intended to address. Without a more responsive approach, the gap between formal conformity and effective risk management can continue to widen.

The solution is not necessarily to rewrite entire standards annually, but to introduce a more responsive model:

• Continuous control evolution: Update supporting controls and implementation guidance as new risks emerge.
• Dynamic annexes: Allow technical and operational controls to evolve independently of the core management system requirements.
• Risk-driven updates: Introduce timely guidance addressing emerging threats, vulnerabilities, and technological developments.
• Industry participation: Establish more responsive mechanisms for practitioners, auditors, and organizations to identify gaps and recommend changes.
• Living standards: Move toward continuously maintained digital standards rather than relying exclusively on periodic publication cycles.

This approach would allow ISO to preserve the consistency organizations need for implementation and certification while making it easier to respond to developments that cannot reasonably wait for the next full revision. It would also give practitioners a clearer route for addressing emerging risks without having to interpret every new development through requirements that may no longer reflect current conditions.

ISO standards generally undergo systematic review at intervals of up to five years. However, that doesn't mean changes can't be made to certain standards and controls between larger systematic reviews. Emerging risks need to be translated into updated, authoritative requirements and guidance.

The true definition of compliance is about enabling organizations to manage current and emerging risks. But the current system can place too much emphasis on demonstrating conformity with requirements developed years earlier. Meeting a published requirement remains important, but organizations also need to understand whether their controls continue to address the risks they face today.

There is also a distinction between changing a standard and improving the guidance used to implement it. Core management-system requirements can remain stable enough to support consistent certification, while supporting controls, technical guidance, and implementation recommendations evolve as technology and risk change. A more flexible model would help organizations adapt without creating unnecessary disruption every time a new threat or technology emerges.

‍

ISO has an opportunity to lead this transformation.

Its standards must remain stable enough to support consistent certification while becoming sufficiently adaptable to address rapidly changing business and technology environments.

That requires a more active feedback loop between standards development and operational experience. Organizations implementing standards, auditors assessing them, and specialists managing emerging risks are often the first to see where existing guidance falls short. Creating effective ways to capture that experience and translate it into timely updates would help keep standards connected to the environments they are intended to govern.

This would enable ISO to maintain a state of continuous relevance. Because the real question for ISO is:

If technology, threats, and regulations evolve continuously, why shouldn't the standards designed to govern them do the same?

‍

Need help with ISO standards?

Get in touch. We'd love to help.

‍

‍