The transition from ISO/IEC 27001:2013 to the 2022 edition ended on 31 October 2025 under IAF MD 26, and every certificate issued against the 2013 edition expired or was withdrawn on that date, regardless of the expiry date printed on it. A transition audit is no longer possible, because there is no longer a valid 2013 certificate to transition. The way back is a new initial certification against ISO/IEC 27001:2022: a Stage 1 and a Stage 2 audit by an accredited body. The ISMS you ran under the 2013 edition is most of the work already done; what changes is the Annex A structure, a few clauses, and the Statement of Applicability, which has to be rewritten against the 93 controls.
A number of organisations arrived in November 2025 with an ISO 27001:2013 certificate whose printed expiry date was still a year away, a buyer who had just rejected it, and no clear idea why. This article explains what the transition rules did, what the 2022 edition changed, and the shortest path to a current certificate.
What happened on 31 October 2025
ISO/IEC 27001:2022 was published in October 2022. The International Accreditation Forum set the transition rules in IAF MD 26: a three-year transition period, during which certification bodies audited clients against the new edition at a surveillance, recertification or dedicated transition audit, and at the end of which all certificates to the 2013 edition would expire or be withdrawn. National accreditation bodies applied those rules to the certification bodies they accredit. So on 31 October 2025 every remaining 2013 certificate stopped being valid, and the certification bodies' registers now show them as expired or withdrawn even where the paper certificate carries a later date.
Why a transition audit is no longer possible
A transition audit moved a valid certificate from one edition to the next. Once the 2013 certificate has expired there is nothing to move, so the certification body has to treat you as a new client for the 2022 edition: a Stage 1 readiness review and a Stage 2 certification audit, with a new certification decision and a new three-year cycle starting from it. The Stage 1 versus Stage 2 article explains both. The difference from a first-time client is that you arrive with a working ISMS and three years of records, which shortens everything.
What changed between the 2013 and 2022 editions
| Area | 2013 edition | 2022 edition | What to do |
|---|---|---|---|
| Annex A structure | 114 controls in 14 domains (the 2013 numbering, A.5 to A.18) | 93 controls in four themes: organisational, people, physical, technological | Rebuild the Statement of Applicability against the 93 controls using the correspondence table in Annex B of ISO/IEC 27002:2022 |
| New controls | Not present | Eleven new controls, including threat intelligence, cloud services, configuration management, data leakage prevention, monitoring and secure coding | Assess each against your risks and add the ones your treatment plan needs |
| Clause 4.2 | Interested parties and their requirements | Adds which of those requirements will be addressed through the ISMS | Note the decision in the interested-party register |
| Clause 6.3 | Not present | Planning of changes to the ISMS | Record how changes to the ISMS are planned |
| Clause 8.1 | Operational planning and control | Reworded to cover processes needed to meet requirements, including externally provided ones | Check outsourced processes are controlled and documented |
| Clause 9.3 | Management review inputs | Adds changes in needs and expectations of interested parties | Add the input to the review agenda |
| Clause 10 | 10.1 nonconformity, 10.2 improvement | Order swapped: 10.1 continual improvement, 10.2 nonconformity and corrective action | Update references in procedures |
| Amendment 1 (2024) | Not present | Climate change added to clauses 4.1 and 4.2 | Record whether climate change is a relevant issue |
The Annex A guide lists all 93 controls, and the Statement of Applicability article covers the rebuild.
The shortest path back
- Confirm the status with your certification body and ask what it needs for initial certification against the 2022 edition; some will reuse their knowledge of your ISMS in planning Stage 1.
- Rebuild the Statement of Applicability against the 93 controls, with the risk assessment refreshed and the eleven new controls decided.
- Apply the clause changes: interested-party requirements addressed, planning of changes, the management review input, the clause 10 references, and the climate change consideration.
- Check the records are continuous. If the ISMS kept running, the internal audits, management reviews and control evidence since the last 2013 audit are what Stage 2 will sample. If it stopped, run an internal audit and a management review now and start the evidence again.
- Book Stage 1 and Stage 2 with the gap needed to fix what Stage 1 finds. The timeline article gives the ranges.
- Tell customers. A written statement from the certification body that recertification to the 2022 edition is scheduled, with dates, is accepted by most buyers while they wait.
What to tell buyers in the meantime
Do not present the 2013 certificate as current, even if its printed date has not passed; the buyer's reviewer checks the register and treats a lapsed certificate presented as valid as a red flag. Say that the certificate expired with the edition on 31 October 2025, that the ISMS has continued to operate, and that recertification against ISO/IEC 27001:2022 is booked, with the Stage 2 date. Offer the last internal audit report and the current Statement of Applicability under NDA where the deal needs it. The scope article covers what the new certificate should say when it arrives.
Primary sources
- INAB — transition requirements for ISO/IEC 27001:2022 under IAF MD 26 (end of transition 31 October 2025)
- IAF MD 26 — transition requirements for ISO/IEC 27001:2022, International Accreditation Forum
- ISO/IEC 27001:2022 — information security management systems, ISO
- ISO/IEC 27002:2022 — information security controls (Annex B maps the 2013 and 2022 controls), ISO