ISO/IEC 27001:2022 Transition Deadline — What You Need to Know Before 31 October 2025

May 15, 2025

The cybersecurity landscape continues to evolve at pace—bringing with it new threats, technologies, and regulatory demands. In response, the international standard for Information Security Management Systems (ISMS), ISO/IEC 27001, has undergone a significant update.


If your organisation is currently certified under ISO/IEC 27001:2013, it’s critical to prepare for the transition to ISO/IEC 27001:2022—and soon. As of 31 October 2025, all ISO/IEC 27001:2013 certifications will become invalid.


In this blog, we’ll walk you through the key changes, transition deadlines, risks of non-compliance, and the steps your business needs to take to stay secure—and certified.

What Is ISO/IEC 27001, and What Changed in 2022?

ISO/IEC 27001 is the world’s leading standard for establishing, implementing, and maintaining an ISMS. It enables organisations to manage sensitive information securely ensuring confidentiality, integrity, and availability.


The 2022 revision modernises the standard to reflect today’s cybersecurity realities. Key updates include:


  1. Broader scope: Now explicitly addresses cybersecurity and privacy protection.
  2. Structural refinements: Clauses 4–10 have been clarified for improved planning and integration.


Annex A controls reduced from 114 to 93, now grouped into four domains:


  • A.5: Organisational
  • A.6: People
  • A.7: Physical
  • A.8: Technological


11 new controls introduced, covering areas like threat intelligence, secure coding, data masking, and cloud services.


These changes make the standard more practical, scalable, and relevant for modern businesses.

Why 31 October 2025 Is a Critical Date

The International Accreditation Forum (IAF) has mandated that all ISO/IEC 27001:2013 certifications must transition to the 2022 standard by 31 October 2025. After this:


  • 2013 certificates will no longer be valid.
  • Certification bodies will only issue ISO/IEC 27001:2022 certificates.
  • Organisations still using the 2013 framework will be considered non-compliant.


Delaying the transition not only risks certification loss, but could also impact client trust and legal compliance.

What Are The Risks of Missing the Transition Deadline?

Failing to act on the transition can pose serious risks:


  • Loss of Certification

Without an updated certificate, your organisation may face contract terminations, compliance issues, or exclusion from procurement opportunities.


  • Operational Disruption

Many clients and partners require valid ISO/IEC 27001 certification. A lapsed certificate could stall projects and collaborations.


  • Regulatory Consequences

ISO certification often supports compliance with laws like GDPR or HIPAA. Falling behind could expose you to legal or financial penalties.


  • Reputational Damage

An expired certificate may signal weak governance—undermining stakeholder confidence, especially in sectors like finance, healthcare, and government.

Key Transition Milestones

Milestone Date
ISO/IEC 27001:2022 Published 25 October 2022
Transition Period Begins 31 October 2022
New Certifications Must Use 2022 Standard 1 May 2024
Recommended Completion of Transition Audits 31 July 2025
Final Expiry of 2013 Certificates 31 October 2025

Transition Checklist: Your Six-Step Plan

Phase 1: Understand the Changes

  • Review the 2022 standard thoroughly.
  • Identify internal stakeholders and key decision-makers.


Phase 2: Gap Analysis

  • Map existing controls to the new Annex A structure.
  • Identify additions, updates, or removals.


Phase 3: Update Documentation

  • Revise your Statement of Applicability (SoA).
  • Update risk assessments and policies.
  • Align with updated Clause 6.3 (change planning) and Clause 9.3 (management reviews).


Phase 4: Training and Awareness

  • Conduct training on new control requirements.
  • Run awareness sessions for affected teams.
  • Ensure control owners understand their revised roles.


Phase 5: Internal Audit

  • Audit against the 2022 standard.
  • Resolve nonconformities.
  • Perform a full management review.


Phase 6: Schedule the Transition Audit

  • Engage your certification body early.
  • Submit revised documentation.
  • Complete the audit well before the October 2025 deadline.

Spotlight on New Controls

Some of the most impactful new additions include:


  • 5.7 Threat Intelligence – Stay informed on emerging threats from reliable sources.
  • 5.23 Cloud Security – Manage cloud provider risks with contractual and technical controls.
  • 8.11 Data Masking – Protect sensitive data through masking techniques.
  • 8.28 Secure Coding – Integrate secure development practices to reduce software vulnerabilities.


These reflect real-world concerns that organisations face today and must be addressed in your ISMS.

Frequently Asked Questions

Q: Can We Wait Until 2025 to Start?

Technically yes—but it’s risky. Delaying increases the chances of:


  • Auditor backlogs
  • Resource constraints
  • Poor transition execution
  • Lost certification due to missed deadlines


Best practice: Start at least 12–18 months in advance.

Q: Do We Need a Full Recertification?



Not if you transition before your current certificate expires.


Instead of a full audit, you’ll undergo a transition audit, which reviews changes made to meet 2022 requirements. However, if your 2013 certificate lapses, you’ll need to go through full recertification—a more demanding and expensive process.

Q: How Long Will It Take?


It depends on your organisation’s size and ISMS maturity:


  • SMEs: 3–6 months
  • Large/multi-site organisations: 6–12 months
  • Complex/regulatory sectors: Up to 18 months


The key time-drivers include updating documentation, training, and audit preparation. Starting early ensures fewer disruptions and better outcomes.

Why Compliance Is Worth the Effort

Beyond avoiding risk, transitioning to ISO/IEC 27001:2022 offers tangible benefits:


  • Modernised security posture: Addresses current threats like cloud, AI, and data privacy.
  • Simplified control framework: Easier to implement, manage, and scale.
  • Stronger business credibility: Enhances client trust and competitiveness.
  • Regulatory assurance, demonstrating alignment with global standards and data protection laws.

Don’t Delay

The ISO/IEC 27001:2022 transition isn’t just a compliance task—it’s a chance to enhance your security framework, modernise processes, and reinforce your organisation’s reputation.


With the 31 October 2025 deadline fast approaching, the time to act is now.


  • Begin planning
  • Assign responsibilities
  • Schedule your transition audit early


If get ahead, you can acheive the new standard upgrade.

At Cybergen Security, we help organisations of all sizes transition smoothly to ISO/IEC 27001:2022. If you're unsure where to begin, we offer:


  • Expert consultancy and audit prep
  • Support with automation platforms such as Vanta
  • In-house or online ISO 27001:2022 training


Get in touch today to safeguard your certification and ensure a compliant, future-ready ISMS.

Safeguard your IS027001 certification and stay compliant.

Let's get protecting your business

Blue shield with a padlock icon in a digital background with binary code, representing cybersecurity.
February 23, 2026
Why compliance-driven security fails in 2026. Learn how attackers exploit identity and attack paths, and how intelligence-led penetration testing reduces real cyber risk
Woman presenting AI concept on screen, pointing with a laptop. Blue tones, glowing
February 21, 2026
How AI is transforming cyber attacks in 2026, from deepfake phishing to adaptive malware — and what CISOs must do now to reduce risk and strengthen resilience.
Laptop with a fingerprint scan graphic overlaid, symbolizing secure access.
February 17, 2026
Why traditional penetration testing fails in 2026, and what effective, risk-driven testing really looks like. Discover how to move beyond CVSS scores and vulnerability lists to attacker-focused attack paths, identity compromise, lateral movement, and measurable risk reduction that actually improves security outcomes.
Person wearing VR headset, text
February 11, 2026
Explore the future of cybersecurity in 2026. Discover emerging threats, evolving attack methods, and how organisations can stay resilient in a changing threat landscape.
Man looking at a digital interface with holographic building model, graphs, and code overlays, indoors.
February 11, 2026
Cyber threat intelligence reveals how modern ransomware attacks really start: credential abuse, trusted access, and quiet pre-positioning long before impact.
Red and blue digital graphic with the word
February 5, 2026
CREST pen testing reveals what really happens after initial compromise. Learn how attackers escalate privileges, move laterally, and how testing exposes real risk.
Notepad++ code editor window with C++ code and Notepad++ logo with a gecko.
February 3, 2026
Notepad++ update infrastructure was hijacked in a targeted supply-chain attack. Learn what happened, who was behind it, and why it matters.
Hand holding magnifying glass over digital warning sign on screen.
February 1, 2026
High-severity vulnerabilities don’t equal real cyber risk. Learn why CVSS-driven risk registers fail, how attackers exploit exposure, and how CTEM reduces real-world risk.
Hand touching a glowing security shield interface with a binary code background.
February 1, 2026
Breaches persist despite audits and investment. Learn how threat-led security turns cyber activity into prioritised risk reduction with threat intelligence, MDR and CTEM.