After ISO/IEC 27001:2022 was published, certified organizations had three years to update their ISMS, in particular the Statement of Applicability against the restructured Annex A, and to have a certification body verify the changes in a dedicated transition audit or as part of a surveillance or recertification audit. Certificates issued against the 2013 edition expired or were withdrawn at the end of the period.
An organization whose 2013 certificate lapsed cannot transition any more: it needs a full Stage 1 and Stage 2 audit against the 2022 edition.
Read more
Related terms
- Stage 1 audit
- A Stage 1 audit is the first part of an ISO 27001 certification audit, in which the certification body reviews the ISMS documentation and readiness for Stage 2.
- Stage 2 audit
- A Stage 2 audit is the main part of ISO 27001 certification, in which the certification body tests that the ISMS is implemented and operating as documented.
- Recertification audit
- A recertification audit is the full audit a certification body performs before an ISO certificate's three-year term ends, to issue a new one for the next cycle.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.