Transition to ISO 27001:2022: Lessons and Key Steps Now the Deadline Has Passed

Update (2026): the ISO 27001:2013 → 2022 transition window closed on 31 October 2025. If your organization missed it, see what a lapsed certificate means and how recertification works.

The transition to ISO 27001:2022 is over: the window closed on 31 October 2025, and any certificate still referencing the 2013 edition is no longer valid. That changes what this topic means in 2026. If you transitioned in time, the job now is running the 2022-edition ISMS well. If you did not, the path is not a late transition — it is recertification to :2022. And for everyone, the transition just completed is the best rehearsal available for the revision wave arriving across other standards. This post covers all three: where you stand, how recertification works, and the lessons worth keeping.

Where the deadline leaves you

Certification bodies could not conduct transition audits after the cutoff, so 2013-edition certificates ceased to be valid at the deadline regardless of the expiry date printed on them — and verification registries reflect that, which matters because clients’ vendor-risk teams and tender committees check registries, not framed paper. If your certificate lapsed, the honest status is uncertified: vendor reviews that ask “do you hold a valid ISO 27001 certificate?” must now be answered no. The practical mechanics of a lapsed certificate — and the fastest legitimate route back — are covered in our ISO 27001:2013 to :2022 guide.

Still on 2013? The recertification path

The route back is a full initial certification to ISO/IEC 27001:2022 — Stage 1 and Stage 2 with an accredited certification body — but it is faster than starting from nothing, because your operating discipline survives even when the paper does not. The work is an update: update the risk assessment and Statement of Applicability to the 2022 Annex A (93 controls in four themes — organizational, people, physical, technological), implement the additions the 2022 edition brought (threat intelligence and cloud services security among them), refresh documentation references, retrain where roles changed, and run a full internal audit and management review on the updated system before the CB arrives. Companies that kept their ISMS genuinely running typically need the update work plus evidence accumulation, not a rebuild — the ISO 27001 guide covers the full process, and the cost guide the budget lines. Be straight with counterparties during the gap: clients mid-contract deserve to know your recertification date, and a scheduled Stage 2 with an accredited CB is an answer most vendor-risk teams will work with — silence followed by discovery is the version that costs accounts.

What the 2022 edition changed — and why it aged well

The 2022 revision consolidated Annex A from fourteen clause families into four themes and 93 controls, retired duplications, and added controls for the realities that now dominate questionnaires: threat intelligence, cloud services security, secure development discipline. Three years on, the redesign reads as prescient — the controls added in 2022 map directly onto the cloud and supply-chain scrutiny every Philippine provider now faces from enterprise clients. If your transition was a paperwork exercise, 2026 is the year to make those controls real: they are the ones auditors sample hardest and clients probe deepest.

Five lessons the transition taught — worth keeping

Watching organizations cross the window (and some miss it) left a consistent lesson set. Start when the clock starts, not when it runs low — late movers found CB audit calendars full in the final year. Gap-assess before planning — organizations that mapped the changes first bought only the work they needed. Fold the transition into a scheduled audit — surveillance and recertification visits absorbed transition audits cheaply; standalone transition audits cost more. Update the SoA before the controls — the mapping document drives everything downstream. Keep leadership in the loop — risk acceptance and resourcing decisions stalled wherever the transition was treated as an IT errand. And a sixth, learned by the companies that never felt the deadline at all: a maintained system absorbs revisions almost incidentally. Where internal audits, management reviews and record discipline ran on calendar — the rhythm our ISO maintenance service exists to guarantee — the transition was a scheduled audit with extra reading, not a project. None of these lessons is 27001-specific, which is exactly why they matter now.

The next transition clocks are already running

The revision wave continues: ISO 14001:2026 and ISO/IEC 27701:2025 are published with transition windows open, ISO 9001:2026 was published on 16 September 2026 — the ISO 9001:2026 playbook tracks it — and ISO 45001 and ISO 22000 revisions follow in 2027. Every deadline lives on our ISO Standards Revision Tracker, updated as ISO and IAF confirm. Apply the five lessons above from day one this time: early gap analysis, transition folded into scheduled audits, SoA-equivalent mapping first. Organizations that treat the 27001 experience as a template will cross the next windows without drama — and at a fraction of the panic price.

Related: the lapsed-certificate and recertification guide, the ISO 27001 certification guide, the revision tracker for every transition deadline, and the signed letters from Philippine ISMS projects that crossed the window cleanly — or book a free consultation and get your recertification plan mapped this week.

Reviewed by Ann Reyes, Lead Auditor (Davao), Sterling International Consulting.