For three years, organizations certified to ISO/IEC 27001 had a clear deadline on the calendar. That deadline has now passed. Under IAF MD 26, the International Accreditation Forum’s mandatory transition document, certification bodies had to complete the transition of certified clients to ISO/IEC 27001:2022 by 31 October 2025.
The same document is direct about what happens next: all certifications based on ISO/IEC 27001:2013 “shall expire or be withdrawn at the end of the transition period.” In practice, the expiry date printed on an old certificate no longer tells the full story.
Where does your organization stand?
Most certified organizations fall into one of three situations.
You transitioned on time
Your certificate now references the 2022 edition. The work is not finished, though. A transition audit confirms that the new requirements are in place; surveillance audits will test whether they actually operate over time. Expect auditors to look for evidence that the newer controls are part of daily practice, not just policy text.
You transitioned, but in a hurry
Some organizations moved late and closed gaps with documentation written for the audit. That is a common pattern and it is fixable. Use the period before your next surveillance visit to replace paper controls with working ones: assign owners, collect evidence on a schedule and review results with management.
You did not transition
If your certificate was still on the 2013 edition at the deadline, it is no longer a valid accredited certificate. Your customers may not have noticed yet, but procurement and vendor-risk teams do check. Talk to your certification body about what is now required to certify against the 2022 edition, and tell key customers what you are doing before they ask.
Do not forget the climate amendment
In February 2024, ISO published ISO/IEC 27001:2022/Amd 1:2024, Climate action changes. According to the joint ISO–IAF communiqué, clause 4.1 now requires the organization to determine whether climate change is a relevant issue, and a note added to clause 4.2 says relevant interested parties can have climate-related requirements.
This is a small change, but auditors will ask about it. A short, documented analysis is usually enough: does climate change affect your facilities, suppliers, hosting regions or availability commitments? If the answer is yes, show how it feeds into your risk assessment. If the answer is no, record why.
Five practical steps for the next twelve months
- Confirm your certificate. Check that the certificate itself, and the listing your certification body publishes, reference ISO/IEC 27001:2022. Share the updated certificate with customers who keep it on file.
- Refresh your Statement of Applicability. Make sure every Annex A control is either justified as applicable with a named owner, or excluded with a clear reason. Stale or copied justifications are a frequent audit finding.
- Re-run your risk assessment. If your last full assessment was done before the transition, the controls you selected may not reflect current threats, suppliers or systems.
- Schedule evidence collection. Access reviews, supplier reviews, backup tests and incident exercises should happen on a calendar, with results kept in one place. This is where a governance tool such as Accel GRC saves time.
- Test, do not just document. Technical controls such as secure configuration, logging and vulnerability management should be verified. An independent security test gives you evidence that holds up with both auditors and customers.
Why this matters beyond the certificate
Customers rarely read an ISMS manual. They read the certificate, the scope statement and, increasingly, the answers in your security questionnaires. An out-of-date certificate or a scope that does not match the services you sell creates friction in sales and renewals.
In Canada, certification bodies offering accredited ISO/IEC 27001 certification are accredited by bodies such as the Standards Council of Canada. When you share your certificate, it helps to point customers to the accreditation mark so they can verify it themselves.
A note on scope
The transition is a good moment to ask whether your certified scope still fits the business. New products, cloud regions, acquisitions or outsourced functions may sit outside the original boundary. Extending scope at your next audit is usually simpler than explaining to a customer why the service they buy is not covered.
How we can help: Ubitrak supports organizations with ISO 27001 readiness, gap assessments and internal audits, and Accel GRC keeps controls, owners and evidence in one place. See our ISO 27001 page, learn about a security review or remediation support, or contact us to discuss your next surveillance audit.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult