ISO 27001 Climate Change Amendment Evidence Guide

It is 09:10 on the morning of your ISO/IEC 27001:2022 surveillance audit. The auditor has already reviewed your risk register, Statement of Applicability, management review minutes, supplier register, and business continuity exercise report. Then comes the question that catches the room off guard:

“Show me how you determined whether climate change is relevant to the ISMS.”

The CISO looks at the compliance manager. The compliance manager opens the legal register. Someone mentions ESG. Someone else says the data centre provider has ISO certificates. The auditor waits.

That moment is the practical evidence gap created by the ISO management system climate change amendment. The amendment does not ask security teams to become climate scientists, calculate cloud carbon emissions, or create a decorative “climate security control.” It asks a more direct management system question: has the organization considered whether climate change is relevant to its context, and whether interested parties have climate-related requirements that affect the management system?

For ISO/IEC 27001:2022, that means the evidence must connect across Clauses 4 through 10: context, interested parties, scope, risk planning, operational control, performance evaluation, management review, and continual improvement. The amendment is not passed by saying “not applicable” in a meeting. It is passed by showing a reasoned, documented, risk-based decision.

A fintech CISO named Sarah faced the same question a few weeks before audit. Her first reaction was familiar: climate change felt outside the ISMS, while her team focused on cyber threats, data breaches, cloud security, DORA readiness, and customer due diligence. But once she translated the amendment into practical ISMS language, the issue became concrete: severe weather could affect cloud region availability, a supplier in a water-stressed region could delay critical hardware replacement, a prolonged power outage could disrupt incident response staffing, and customers could require proof of operational resilience.

That is the right framing. Treat climate change as a context and resilience input to the ISMS, not as a bolt-on topic.

Clarysec’s approach uses Zenith Blueprint: An Auditor’s 30-Step Roadmap, Zenith Controls: The Cross-Compliance Guide, and Clarysec policy templates to convert a new audit question into traceable evidence. The goal is simple: show the auditor a clean chain from context to risk, risk to controls, controls to evidence, evidence to management review, and management review to improvement.

The amendment changes the audit question, not the ISMS mission

The most common mistake is treating the ISO 27001 climate change amendment as a separate control domain. It is not. For an ISMS, the real question is whether climate change can affect intended information security outcomes, especially confidentiality, integrity, and availability.

The amendment adds climate change as a specific consideration under ISO management system context requirements. For ISO/IEC 27001:2022, auditors will usually test two points first:

• Clause 4.1, whether the organization determined if climate change is a relevant external issue.
• Clause 4.2, whether relevant interested parties have climate-related requirements.

The keyword is “determined.” An organization can determine that climate change is not relevant, relevant only to certain locations or services, or relevant to the entire ISMS. But the determination must be documented and supported by the organization’s actual dependencies.

For example, a SaaS provider may decide climate relevance exists because production availability depends on a small number of cloud regions, a managed service provider, and remote incident response staff. A fintech may connect the amendment to critical ICT third-party dependencies, DORA operational resilience, regulated incident reporting, and board accountability. A manufacturer may focus on OT network availability, plant connectivity, remote monitoring, and physical site disruption.

A mature evidence set should appear in the same places where the organization already proves its ISMS works.

The strongest audit evidence does not sit in a standalone “climate file.” It appears in normal ISMS records and shows that the management system can respond to changes in external context.

Start with context, interested parties, and scope

Climate relevance starts in context. The organization should record a clear determination: relevant, not relevant, or partially relevant. “Relevant” does not mean catastrophic. It means capable of affecting intended information security outcomes.

In Zenith Blueprint, the ISMS Foundation & Leadership phase starts with context analysis. Step 1 states:

Action Item 4.1: Brainstorm a list of internal and external factors that are relevant to your organization’s information security.

The same guidance recommends broad external analysis, including environmental factors through techniques such as PESTLE. This is where the climate amendment becomes operational. Instead of asking, “Do we have a climate control?” the team asks:

• Which physical locations, data centres, cloud regions, networks, and suppliers support in-scope services?
• Could severe weather, heat, wildfire, flooding, water stress, energy instability, or transport disruption affect availability, integrity, or confidentiality?
• Do customers ask for climate resilience or operational resilience evidence during security due diligence?
• Do regulators, insurers, investors, or public-sector clients impose business continuity, disaster recovery, or availability expectations?
• Could climate adaptation projects introduce new technology risks, such as building management integrations, IoT sensors, environmental monitoring, or rapid cloud migration?
• Are there privacy implications if new monitoring includes employee, location, device, or environmental data linked to people?

For Sarah’s fintech team, the context workshop produced four realistic external issues: storm exposure at a data centre region, concentration in a single cloud region, dependency on a hardware supplier in a water-stressed area, and regulatory expectations under DORA and NIS2.

The next step is interested parties. The amendment requires organizations to determine whether interested parties have climate-related requirements. Those parties may include customers, regulators, insurers, cloud providers, investors, boards, or critical suppliers.

Step 2 of Zenith Blueprint connects this analysis to ISMS scope:

Action Item 4.3: Draft an ISMS scope statement. List what is included (business units, locations, systems) and any exclusions.

This matters because climate-related disruption often enters through interfaces and dependencies. An organization may say its office is not material because production is cloud-hosted, but the auditor may ask whether customer support, privileged access, incident response, backup administration, vendor escalation, or crisis communication depends on people, sites, or suppliers outside the scope.

Clarysec’s Enterprise Information Security Policy sets the baseline:

The organization shall implement and maintain an Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022 Clauses 4 through 10.

It also requires the evidence structure auditors expect:

The ISMS shall include defined scope boundaries, a risk assessment methodology, measurable objectives, and documented controls justified in the Statement of Applicability (SoA).

Those words are the core of amendment readiness: scope boundaries, risk methodology, measurable objectives, and SoA justification.

Turn climate context into information security risks

The best evidence is rarely a generic risk called “climate change.” Climate change is the context driver. The risk scenario should describe the information security consequence.

Strong risk scenarios look like this:

• Extreme weather disrupts access to the primary office during a security incident, delaying privileged response and customer communications.
• Regional heatwave increases probability of cooling or power instability at a data centre supporting production workloads.
• Flooding affects a critical supplier’s service desk location, delaying restoration of managed endpoint protection services.
• Customer climate resilience requirements are not captured in the compliance register, creating contractual nonconformity and audit findings.
• Emergency cloud migration to reduce physical site dependency bypasses standard change and supplier risk review.
• Climate adaptation monitoring devices are connected to the corporate network without asset registration, logging, or vulnerability management.

These are information security risks because they affect availability, incident handling, supplier assurance, asset management, legal obligations, secure change, or privacy.

Clarysec’s Risk Management Policy - SME states:

All identified risks must be recorded in the Risk Register.

It also reinforces review cadence:

Risks must be reviewed quarterly and updated when significant events occur.

For enterprise organizations, Clarysec’s Risk Management Policy broadens the input model:

Inputs for risk identification shall include, but are not limited to, audit findings, vulnerability scans, penetration testing reports, incident trends, legal obligations, and operational changes.

Climate relevance can arise from any of those inputs. A customer audit finding may identify missing resilience evidence. A legal update may add operational resilience obligations. A cloud migration may move workloads into a different regional exposure profile. A business continuity test may reveal that staff cannot access recovery procedures during a power outage.

Each risk should have an owner, likelihood, impact, treatment decision, residual risk position, and review date. If the organization concludes there is no material climate-related information security risk, that conclusion still needs rationale.

Use the Statement of Applicability to convert risk logic into control logic

Once climate-related scenarios are recorded, the next question is whether controls are necessary and whether the Statement of Applicability reflects the decision. ISO/IEC 27001:2022 Clauses 6.1.1 to 6.1.3 require planned actions for risks and opportunities, risk assessment, risk treatment, necessary controls, Annex A comparison, and a SoA with inclusion and exclusion justifications.

In the Risk Management phase, Step 13 of Zenith Blueprint gives a practical traceability model:

Cross-reference regulations: If certain controls are implemented specifically to comply with GDPR, NIS2, or DORA, you can note that in either the Risk Register (as part of risk impact justification) or in the SoA notes.

Use the same principle for the climate change amendment. Do not invent a control. Map the scenario to existing ISO/IEC 27002:2022 controls and explain why they are applicable.

The enterprise Risk Management Policy makes the SoA trigger explicit:

The SoA shall be reviewed following each major risk assessment or significant environmental change.

That clause is highly relevant. A significant environmental change may be literal, such as updated flood exposure for a facility, or operational, such as changing data centre providers, moving workloads, opening a new support site, or accepting a regulated customer with resilience requirements.

A strong SoA rationale is specific:

“Control A.5.30 is applicable because RR-31 identifies potential service disruption from extreme weather affecting primary support operations. Treatment includes remote incident coordination, tested recovery procedures, annual ICT readiness exercise, and cloud failover validation.”

That is stronger than “Applicable because ISO requires it.”

Use policy evidence to make the amendment repeatable

The amendment should not create a one-time scramble before audit. It should become part of the management system’s normal review cycle.

Clarysec’s Legal and Regulatory Compliance Policy - SME states:

Any change affecting compliance must trigger a review of the Compliance Register and relevant policies.

Add the ISO management system climate change amendment to the compliance register, then cross-reference related customer, regulatory, contractual, insurance, and certification obligations. If the organization is in a NIS2 or DORA environment, link those obligations to business continuity, incident reporting, supplier assurance, and governance evidence.

For business continuity, Clarysec’s Business Continuity Policy and Disaster Recovery Policy - SME expects evidence:

that disruption scenarios were considered and tested as part of risk assessments

That is where climate scenarios become operational. A tabletop test for regional power loss, a backup restoration exercise, a cloud failover validation, or a supplier support outage simulation can all support the amendment if linked to the risk register.

For audit governance, Clarysec’s Audit and Compliance Monitoring Policy - SME states:

Audit findings and status updates must be included in the ISMS management review process.

If an internal audit identifies weak climate amendment evidence, the finding should not stay in an audit tracker. It should feed management review, corrective action, and continual improvement.

Privacy evidence matters where climate adaptation changes personal data processing. Clarysec’s Privacy Information Management System Policy requires context discipline:

[Both] The Privacy Lead / PIMS Manager MUST document external and internal privacy context issues in REG01 annually and within 30 days of any material change.

It also requires interested-party requirements to be captured:

[Both] The Privacy Lead / PIMS Manager MUST document relevant interested parties and their PIMS requirements in REG01 annually and within 30 days of any material change.

For privacy risks and DPIAs, the Privacy Risk Assessment and DPIA Policy adds:

[Both] The Privacy Lead / PIMS Manager MUST report privacy risk and DPIA status from REG04 to REG12 quarterly and before each management review.

The PIMS Monitoring, Audit and Improvement Policy provides a management review pattern that is useful beyond privacy:

[Both] Top Management MUST review PIMS nonconformity, corrective action, monitoring result, audit result, privacy risk, supplier assurance, and interested-party change inputs in REG12 during each management review.

And the PIMS Documented Information and Evidence Management Policy reinforces evidence indexing:

[All] The Privacy Lead / PIMS Manager MUST maintain a PIMS documented information index in REG12 before initial PIMS publication and quarterly thereafter.

For ISMS climate amendment readiness, use the same discipline: maintain an evidence index so the audit team can retrieve context, risk, SoA, continuity, supplier, and management review records quickly.

Cross-compliance value: ISO 27001, NIS2, DORA, GDPR, NIST CSF, and COBIT

The ISO 27001 climate change amendment is an ISO management system requirement, but the evidence has broader regulatory and assurance value.

NIS2 requires essential and important entities to apply appropriate and proportionate cybersecurity risk-management measures using an all-hazards approach. Article 21 covers risk analysis, incident handling, business continuity, backup, disaster recovery, crisis management, supply chain security, secure development, effectiveness assessment, training, cryptography, access control, and asset management. Severe weather, energy instability, and supplier disruption fit naturally into that all-hazards lens. Article 20 also requires management bodies to approve cybersecurity risk-management measures and oversee implementation, which aligns with ISO/IEC 27001:2022 management review evidence.

DORA is especially relevant for financial entities. It requires ICT risk management, management body accountability, continuity and recovery plans, digital operational resilience testing, ICT third-party risk management, and continuous improvement. If a financial organization already uses ISMS management review to approve climate-related ICT continuity actions, the same evidence can support a DORA governance narrative.

GDPR becomes relevant when climate adaptation changes personal data processing. Examples include workforce safety monitoring, location tracking during severe weather, new building sensors, environmental monitoring linked to employees, or cloud processing location changes. GDPR accountability, purpose limitation, data minimization, security, retention, and supplier governance all remain applicable during disruption.

NIST CSF 2.0 provides executive language for the same evidence. Its GOVERN function emphasizes organizational context, stakeholder expectations, legal and regulatory requirements, risk management strategy, roles, oversight, and supply chain risk. COBIT 2019 and ISACA-oriented assurance professionals will often focus on ownership, performance metrics, risk acceptance, governance objectives, issue management, and evidence that management knows controls are working.

Zenith Controls is useful here because it helps compliance teams see how the same evidence object supports multiple frameworks. It is not a separate set of controls. It is a cross-compliance guide for mapping ISO/IEC 27001:2022 and ISO/IEC 27002:2022 control logic to audit, assurance, and regulatory expectations.

For this topic, several ISO/IEC 27002:2022 controls are central. A.5.31 Legal, statutory, regulatory and contractual requirements supports the obligation to identify and maintain applicable requirements. A.5.4 Management responsibilities supports leadership accountability. A.5.36 Compliance with policies, rules and standards for information security supports assurance that the rules are followed. A.5.29 and A.5.30 support information security during disruption and ICT readiness for business continuity. A.5.19, A.5.21, and A.5.22 support supplier and ICT supply chain resilience.

Zenith Controls states:

Control 5.36 serves as the enforcement mechanism for the rules defined under 5.1.

In the climate amendment context, that means the organization does not only update a policy. It monitors whether context reviews, risk updates, SoA reviews, continuity tests, supplier reviews, and management review actions actually occur.

Management review is the board-level moment of truth

ISO/IEC 27001:2022 Clause 9.3 requires top management to review the ISMS at planned intervals to ensure continuing suitability, adequacy, and effectiveness. For the climate amendment, management review is where context evidence becomes leadership accountability.

Zenith Blueprint, Audit, Review & Improvement phase, Step 28, tells teams to gather management review inputs including:

✓ Changes in external and internal issues: Summarize any significant changes in context (Clause 4.1) or requirements of interested parties (Clause 4.2) since the ISMS project started.

Sarah used that structure to brief her leadership team. Her management review slide was concise:

1. ISO has mandated consideration of climate change in management system context.
2. The ISMS team determined relevance for data centre availability, cloud concentration, supplier dependency, and regulatory expectations.
3. Two risks were added to the risk register with medium-low likelihood and high impact.
4. Treatment uses existing controls for ICT readiness, supplier management, backups, cloud services, and legal requirements.
5. Management approval is requested for an enhanced disaster recovery test simulating regional power instability.

The minutes recorded the decision, action owners, due dates, and resource approval. That is high-quality audit evidence because it shows top management reviewed the issue and made a risk-based decision.

Clarysec’s Enterprise Information Security Policy requires management review to include:

Decisions on updates to scope, controls, and resource allocation

A strong climate amendment management review pack should include:

• Context register excerpt showing climate relevance determination.
• Interested-party register excerpt showing requirements or rationale for none.
• Scope review covering locations, cloud services, suppliers, support teams, and interfaces.
• Risk register entries and treatment status.
• SoA changes or confirmation that existing justifications remain sufficient.
• Business continuity and disaster recovery test results.
• Supplier assurance updates for cloud, data centre, MSP, MSSP, telecom, facilities, and outsourced support dependencies.
• Incident response implications, including escalation and communication dependencies.
• Legal and regulatory register updates.
• Resource requests, decisions, and residual risk acceptance.
• Improvement actions with owners and due dates.

If the issue never reaches management review, it can look performative. If it reaches management review through context, risk, controls, and evidence, it looks like a functioning ISMS.

Common audit findings and how to prevent them

Most climate amendment findings are traceability failures, not technical failures.

Your audit-ready evidence pack

Before the next surveillance or recertification audit, assemble a concise evidence pack. It does not need to be huge. It needs to be connected.

That pack gives the auditor a clean trail: context to risk, risk to control, control to evidence, evidence to management review, and management review to improvement.

Turn the amendment into evidence, not anxiety

The ISO 27001 climate change amendment is not a paperwork trap if your ISMS already works as a management system. It is a prompt to prove that your organization can recognize a changing external issue, decide whether it matters, evaluate its effect on information security outcomes, update risk and controls where needed, and involve top management in the decision.

Start with a 60-minute evidence review. Bring the context register, interested-party register, ISMS scope, risk register, SoA, BCP test report, supplier register, compliance register, and last management review minutes. Ask one question: can we trace the climate amendment from context to leadership decision?

If the chain is broken, repair it before the auditor finds the gap.

Clarysec can help you build that traceability quickly. Use Zenith Blueprint: An Auditor’s 30-Step Roadmap to place the work in the right implementation phases, use Zenith Controls: The Cross-Compliance Guide to map evidence across ISO/IEC 27001:2022, NIS2, DORA, GDPR, NIST CSF, and COBIT-oriented assurance, and use Clarysec policy templates to make the records repeatable, reviewable, and audit-ready.

Schedule a Clarysec climate amendment evidence assessment and turn an uncomfortable audit question into a confident, board-ready answer.