Missed the ISO 27001:2013 to 2022 Transition? What It Means and What To Do

Last updated: 10 July 2026

The official transition window from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 closed on 31 October 2025. Under the IAF transition arrangements, certification bodies stopped conducting audits against the 2013 edition and withdrew certificates that had not moved to the 2022 edition. This page explains what that means if your organization did not complete the transition — and what to do about it.

Is your certificate still valid? A 60-second check

Look at the standard reference printed on your certificate. If it names ISO/IEC 27001:2013, the certificate is no longer valid under accredited certification — even if the paper shows an expiry date in the future. Certification bodies withdrew unconverted 2013 certificates after 31 October 2025, and most CB verification portals now show them as withdrawn or expired. If it names ISO/IEC 27001:2022, you completed the transition — your next dates to watch are on our ISO Standards Revision Tracker.

What a lapsed ISO 27001 certificate means in practice

For Philippine companies — especially BPOs, IT service providers and anyone processing client data — a lapsed certificate surfaces quickly: tender and RFP submissions that require a valid ISO 27001 certificate fail compliance screening; client security reviews and vendor-assessment questionnaires flag the expired status; contracts that oblige you to “maintain certification” may technically be in breach; and your evidence of due diligence under the Data Privacy Act looks weaker exactly where it used to look strongest. The longer the gap runs, the more explaining each renewal conversation takes.

What recertification to ISO 27001:2022 involves

The good news: if your ISMS kept running after the certificate lapsed, recertification is not a restart from zero. The work is a focused upgrade and a fresh certification audit:

1. Gap review of your controls against the 2022 edition’s Annex A — now 93 controls organized in 4 themes (organizational, people, physical, technological), replacing the old 114.
2. Update the risk assessment and Statement of Applicability to the new control set, including the newer controls (threat intelligence, cloud security, data leakage prevention, secure coding and others).
3. Refresh policies and documentation, close the gaps, and train the team on what changed.
4. Internal audit and management review to prove the system works.
5. Certification audit (Stage 1 + Stage 2) with your certification body — as a new certification, since the old certificate cannot be “revived”.

For an organization that genuinely maintained its ISMS, the whole path typically runs 6–12 weeks; systems that drifted need longer. Either way, the earlier the gap review happens, the shorter the story you have to tell clients.

The anatomy of a fast recertification — what six to twelve weeks actually contains

For previously certified organizations, the recertification sprint compresses well because the skeleton already exists — but each week has a job, and knowing them keeps the sprint honest. The opening week is diagnostic: gap review of your lapsed system against ISO 27001:2022’s structure, with particular attention to the reorganized Annex A — the 93 controls in four themes, including the additions your 2013-era system never addressed: threat intelligence, cloud service security, data leakage prevention, secure coding, configuration management. Weeks two through five rebuild the living tissue: risk assessment refreshed against current operations, Statement of Applicability rewritten to the new control set, policies updated where the standard moved, and — critically — evidence generation restarted, because months-dead records are the loudest thing an auditor can find. The middle weeks run the system deliberately: access reviews performed, awareness delivered, incidents drilled. The closing stretch is audit season: internal audit, findings closed, then Stage 1 and Stage 2 as a new certification, since withdrawn certificates cannot be revived. Twelve weeks is comfortable for an organization that kept its ISMS breathing; six is achievable where discipline survived the lapse.

Answering clients while you recertify

The commercial bridge matters as much as the technical rebuild, because client questions arrive before the new certificate does. The answer that preserves relationships is structured honesty: acknowledge the lapse, show the signed recertification engagement with dates, offer interim evidence — recent internal audit results, the updated Statement of Applicability, penetration test reports where they exist — and give the certification-audit date as a commitment. Procurement teams distinguish sharply between suppliers hiding a lapse and suppliers managing one; the second category routinely survives vendor reviews that the first fails. We support clients through exactly this bridge — evidence packs for client security teams, timelines that hold, and where necessary a direct conversation between our consultants and your client’s auditors. The lapse cost you a certificate, not necessarily the relationship. Start the recertification and the bridge together.

Where to start

Start with the gap review — it tells you in a week what your realistic path back to certification looks like. Contact us for an assessment, and see the ISO Standards Revision Tracker for every other deadline heading your way.