Skip to content

Published · Updated · Global Reviewed by an editor

ISO 27001Rule change

ISO publishes 2022 version of ISO/IEC 27001, ending 2013 audits by 30 april 2024

ISO/IEC 27001:2022 replaces the 2013 edition; audits to the old standard end 30 Apr 2024 and all 2013 certificates expire on 31 Oct 2025.

1 source

What happened

  • ISO/IEC 27001:2022 was published on 25 Oct 2022 and supersedes the 2013 version.
  • A three‑year transition runs until 31 Oct 2025, after which 2013 certifications expire or must be withdrawn.
  • Audits against the 2013 standard will not be performed after 30 Apr 2024.
  • Certificates issued between 1 Nov 2022 and 31 Oct 2025 retain the 31 Oct 2025 expiry date rather than the normal three‑year term.
  • Post‑transition, organisations with expired 2013 certificates will be treated as new clients and require a full initial audit.

Why it matters

Any firm holding an ISO/IEC 27001:2013 certificate must plan a migration to the 2022 edition before the 31 Oct 2025 deadline to avoid losing certification status and facing a full initial audit.

Business impact

Failure to transition will result in loss of certification, affecting client contracts and market credibility; early migration can minimise audit disruption.

Drafted automatically from the sources and checked by an editor. How we write summaries

Does this summary seem wrong?

What to check

  1. Schedule transition auditHigh priority

    Book a special, surveillance, or recertification audit for ISO/IEC 27001:2022 before 31 Oct 2025.

  2. Update control inventoryMedium priority

    Map existing controls to the 93 controls in ISO/IEC 27002:2022, noting new, merged, and updated items.

  3. Train staff on attribute and purpose fieldsMedium priority

    Ensure personnel understand the new control documentation requirements introduced in the 2022 edition.

1 source

Discussion

No comments yet. Start the discussion.

Free account required