ISO/IEC 27001 Transition: What You Should Know

What happened

ISO/IEC 27001:2022 was published on 25 Oct 2022 and supersedes the 2013 version. A three‑year transition runs until 31 Oct 2025, after which 2013 certifications expire or must be withdrawn. Audits against the 2013 standard will not be performed after 30 Apr 2024. Certificates issued between 1 Nov 2022 and 31 Oct 2025 retain the 31 Oct 2025 expiry date rather than the normal three‑year term. Post‑transition, organisations with expired 2013 certificates will be treated as new clients and require a full initial audit.

Why it matters

Any firm holding an ISO/IEC 27001:2013 certificate must plan a migration to the 2022 edition before the 31 Oct 2025 deadline to avoid losing certification status and facing a full initial audit.

Business impact

Failure to transition will result in loss of certification, affecting client contracts and market credibility; early migration can minimise audit disruption.

Checklist

• Schedule transition auditHigh priority

  Book a special, surveillance, or recertification audit for ISO/IEC 27001:2022 before 31 Oct 2025.

• Update control inventoryMedium priority

  Map existing controls to the 93 controls in ISO/IEC 27002:2022, noting new, merged, and updated items.

• Train staff on attribute and purpose fieldsMedium priority

  Ensure personnel understand the new control documentation requirements introduced in the 2022 edition.

Who reported it

Discussion