International information-security management standard; procurement floor across UK CNI; substantially evidences DORA ICT risk-management requirements; 2013-to-2022 transition closed October 2025.