ISO/IEC 27001:2013 certificates expire at transition deadline

The IAF MD 26 transition requirements give teams until 31 October 2025 to migrate ISO/IEC 27001:2013 certificates to ISO/IEC 27001:2022. After that date, legacy certificates lapse. This guide provides a transition playbook, evidence expectations, and control mapping, with navigation to the pillar hub, the ISO/IEC 27001:2022 transition guide, and related briefs on RBI IT governance and NYDFS cyber readiness.

Key dates and certification impact

IAF MD 26 establishes the three-year window; certification bodies must withdraw 2013 certificates after the deadline.

What changes in ISO/IEC 27001:2022

• Annex A restructure. Controls shrink from 114 to 93, grouped under four themes: organizational, people, physical, and technological, aligned to ISO/IEC 27002:2022.
• New and revised controls. Notable additions include threat intelligence (5.7), information security for cloud services (5.23), ICT readiness for business continuity (5.30), and secure coding (8.28).
• Context and planning updates. Clauses 4 and 6 emphasize needs and expectations of interested parties, as well as change management for the ISMS.
• Performance and improvement. Clause 9 highlights monitoring and measurement alignment to updated objectives; Clause 10 stresses continual improvement tied to risk treatment plans.

Visual — transition pathway

        [Gap assess] → [Implement controls] → [Internal audit] → [CB transition audit]
         ↑ ↓
         [SoA update] ← [Metrics & evidence] ← [Management review]
         

Control mapping to accelerate adoption

Statement of Applicability (SoA) update steps

1. Map existing 2013 Annex A controls to the 2022 structure using authoritative crosswalks.
2. Document inclusion/exclusion rationales for each 2022 control with risk references.
3. Update risk treatment plans to cover new controls and revised objectives.
4. Obtain management approval of the refreshed SoA and communicate scope changes to auditors and key customers.

Metrics to track transition readiness

• Control coverage. Percentage of 2022 controls implemented and evidenced; target 100% by August 2025.
• Audit finding burn-down. Open vs. closed findings from internal and CB pre-assessments.
• Training completion. Staff completion rates for secure development, threat intelligence, and cloud security modules.
• BCP test success. Pass rate for failover/restoration tests linked to control 5.30.
• Supplier alignment. Third-party assessments updated to 2022 controls, especially cloud providers.

Audit preparation checklist

• Schedule the transition audit no later than Q3 2025 to allow remediation time.
• Provide CBs with the updated SoA, risk register, and evidence for new controls.
• Run an internal audit and management review aligned to ISO/IEC 27001:2022 Clause 9, capturing performance metrics.
• Refresh incident response, BCP, and supplier management procedures to reflect 2022 terminology and expectations.

Communication plan

Risk scenarios to test

• Cloud service outage. Validate control 5.23 and 5.30 by simulating CSP disruption and executing failover.
• Secure coding regression. Run pipeline checks that fail insecure builds; confirm change management and logging updates.
• Threat intelligence integration. Test ingestion of new indicators and confirm downstream alerting and response.

Document bundle for certification bodies

1. Updated SoA and crosswalk from 2013 to 2022 controls.
2. Internal audit report and management review minutes referencing 2022 clauses.
3. Evidence pack for each new control (artifacts listed above).
4. Supplier assessment updates and contract addenda aligning to new responsibilities.
5. Transition risk assessment and remediation plan with timelines.

References

• IAF MD 26:2022 — Transition requirements for ISO/IEC 27001:2022 and ISO/IEC 27002:2022
• ISO/IEC 27001:2022 standard overview

Gap assessment matrix

Annex A theme check

• organizational (37 controls). Update policies, supplier oversight, and project management controls; ensure KPIs and management review inputs reflect 2022 terminology.
• People (8 controls). Refresh awareness content, onboarding/offboarding processes, and remote work safeguards.
• Physical (14 controls). Confirm visitor management, equipment security, and resilience controls align to current facility footprints.
• Technological (34 controls). Strengthen identity, logging, secure development, and data leakage prevention with measurable baselines.

Visual — 12-month workback plan

        Oct 2025: CB transition audit & certificate reissue
        Aug-Sep 2025: Remediate CB pre-assessment findings
        Jun-Jul 2025: Internal audit + management review
        Apr-May 2025: Implement gaps, finalize SoA
        Jan-Mar 2025: Gap assessment, evidence collection kickoff
         

Cross-framework alignment

• SOC 2. Map 2022 controls to Trust Services Criteria to simplify evidence reuse (for example, logging, BCP, change management).
• NIST CSF 2.0. Align identify-protect-detect-respond-recover activities to updated Annex A themes.
• Sector regulators. For NYDFS or RBI-supervised entities, show how ISO updates reinforce existing regulatory control expectations.

Evidence retention and ownership

Management review focus areas

• Effectiveness of new controls (5.7, 5.23, 5.30, 8.28, 8.32) and associated KPIs.
• Resource allocation for remediation and training through the deadline.
• Supplier dependencies, particularly cloud and critical SaaS vendors.
• Residual risks and planned risk treatment before certification body engagement.