Final period in ISO/IEC 27001:2022 transition calendar

The period defined by IAF MD 26 for the transition to ISO/IEC 27001:2022 was 36 months and that window has closed: ISO/IEC 27001:2013 certificates without a completed transition had to expire or be withdrawn after 31 October 2025.

That is, a valid information security management system certificate today must be issued to ISO/IEC 27001:2022. A certificate referring to the 2013 edition is not considered current evidence of conformity.

The timetable also had intermediate milestones: accreditation bodies being ready to assess the 2022 edition, and certification bodies beginning to carry out initial certification and recertification only to the 2022 edition, were part of that process.

An expired certificate cannot be rescued by a "transition"; the process runs as a new certification. This means a full audit cycle rather than a surveillance audit, and a longer timetable.

Meanwhile the commercial side continues to operate: presenting an out-of-date certificate as if it were valid produces failure in customer due diligence, contractual disputes and problems in supplier evaluation.

The 2022 revision reorganised the Annex A controls: the controls were brought together under four themes and new controls were added. The Statement of Applicability (SoA) must be rebuilt against that new structure.

In practice the hardest part is not mapping the existing controls to the new numbering but establishing genuinely working practice for the newly added controls. Mapping is a table exercise; implementation is a process exercise.

An information security management system certificate does not show that the organisation will never suffer a breach; it shows that the organisation knows its information assets, has assessed its risks and operates the controls it has selected.

The core of the system is risk assessment and the selection of controls. The list of controls in the annex to the standard is not a list of obligations: the organisation decides which controls to apply on the basis of its risk assessment and writes the justification for those it does not apply.

That justification document is the item most closely examined in an audit: not applying a control is not a defect; leaving it unjustified is.

In the final period of a transition two risks come into play together: the auditor's calendar tightens and the time remaining to close any non-conformity found shrinks. When the two combine, the certificate's validity can be interrupted.

The work to be done in that final period is therefore not to start a new exercise but first to establish the current position clearly: which clauses are met, which records are missing and when an audit appointment can be obtained.

Reorganising the control set is the most visible task of the transition: controls are mapped to the new grouping and the statement of applicability is renewed against that structure. Technically this is a mapping exercise; the controls themselves need not be rebuilt.