ISO IEC TR 27023-2015 PDF

Full title and description

ISO/IEC TR 27023:2015 — Information technology — Security techniques — Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002. This technical report provides cross‑reference mapping to show the corresponding relationships between clauses, requirements and controls in the revised editions of ISO/IEC 27001 and ISO/IEC 27002 to aid migration and interpretation.

Abstract

ISO/IEC TR 27023:2015 presents mapping tables and explanatory notes that show how the 2005 editions of ISO/IEC 27001 and ISO/IEC 27002 correspond to the 2013 (revised) editions. It was intended to help organizations, auditors and implementers migrate from the 2005 editions to the 2013 editions by identifying direct correspondences, reorganized material and areas requiring interpretation.

General information

• Status: Withdrawn (withdrawal recorded 26 October 2022).
• Publication date: 2015-07-02.
• Publisher: ISO and IEC (prepared under ISO/IEC JTC 1/SC 27).
• ICS / categories: 35.030 (IT security).
• Edition / version: Edition 1 (2015).
• Number of pages: 19.

Scope

The technical report maps the revised editions of ISO/IEC 27001 and ISO/IEC 27002 so users can identify equivalent clauses, requirements and controls between the older (2005) and revised (2013) documents. It focuses on correspondence and interpretation guidance to support migration, not on introducing new normative requirements.

Key topics and requirements

• Cross‑reference mapping tables linking clauses and controls between editions.
• Explanation of reorganized or renumbered requirements and controls.
• Notes on controls that were added, removed or merged in the revised editions.
• Guidance points for migration planning and auditor interpretation.
• References to the corresponding ISO/IEC 27000‑series background where helpful.

Typical use and users

Used by organizations, information security managers, auditors, consultants and certification bodies during a transition from older editions of ISO/IEC 27001 and ISO/IEC 27002 to the revised editions. It is primarily a reference for mapping and interpretation during migration, gap analysis and audit planning.

Related standards

Primarily relates to ISO/IEC 27001 and ISO/IEC 27002 (the editions in scope for the mapping were the 2005 and 2013 versions). For broader context, see the ISO/IEC 27000 family (for example ISO/IEC 27000) and later editions of 27001 and 27002 (the 2022 editions of ISO/IEC 27001 and ISO/IEC 27002 supersede the 2013 texts and represent the current published versions of those standards).

Keywords

mapping; migration; ISO/IEC 27001; ISO/IEC 27002; information security; controls; technical report; 2015; withdrawn.

FAQ

Q: What is this standard?

A: ISO/IEC TR 27023:2015 is a technical report that provides mapping tables and explanatory notes showing how the revised editions of ISO/IEC 27001 and ISO/IEC 27002 correspond to one another to assist migration and interpretation.

Q: What does it cover?

A: It covers clause‑to‑clause and control‑to‑control correspondence between editions (not normative requirements). The report highlights reorganizations, renumberings, additions and deletions to help users perform gap analyses and plan transitions.

Q: Who typically uses it?

A: Organizations implementing or maintaining an ISMS, consultants, internal and external auditors, and certification bodies—especially during migration from older to revised editions of ISO/IEC 27001 and ISO/IEC 27002.

Q: Is it current or superseded?

A: ISO/IEC TR 27023:2015 has been withdrawn (withdrawal recorded 26 October 2022). It was a guidance/mapping document for the 2013 revisions and has been withdrawn without a direct replacement; users should consult the current published editions of ISO/IEC 27001 and ISO/IEC 27002 for up‑to‑date normative requirements.

Q: Is it part of a series?

A: It is part of the ISO/IEC 27000 family of information security standards (published as a Technical Report to assist understanding between editions). It complements other guidance and normative documents in the 27000 series.

Q: What are the key keywords?

A: Mapping, migration, controls, ISO/IEC 27001, ISO/IEC 27002, information security, technical report, 2015, withdrawn.