The 2013 standard has a completely different structure from the 2005 standard which had five clauses. The 2013 standard puts more emphasis on measuring and evaluating how well an organization's ISMS is performing,[8] and there is a new section on outsourcing, which reflects the fact that many organizations rely on third parties to provide some aspects of IT. It does not emphasize the Plan-Do-Check-Act cycle that 27001:2005 did.