How to Prepare for ISO/IEC 27001:2022

The below blog, originally dated January 26, 2023, has now been updated as the cited IAF MD 26 was updated on February 15, 2023. IAF MD 26 Issue 2 resulted in the following main changes that are now also detailed further within this article (ordered in terms of importance)

Modifying the due date/deadline for conducting the initial certification and recertification reviews against the ISO/IEC 27001:2022 standard
Revising the additional time for transition audits
Updating what changed in ISO/IEC 27001:2013 with the transition to ISO/IEC 27001:2022

When it comes to ISO/IEC 27002:2022 recently, it felt a bit like a game of Red Light, Green Light—you know, the childhood game where everyone runs to the finish line upon Green Light being called, but you had to stop on a dime when you heard “Red Light!” and await the next, random declaration of Green so you could move forward again.

On the playground, it was a game of anticipation, and for those of us that were monitoring this standard, it was very similar, at least until recently—ISO/IEC 27002:2022 was released in February 2022, and on October 25, 25, 2022, ISO 27001:2022 was released as well.

Now that the “green light” on these new versions has officially been given, understanding the timeline for the related transition to ISO/IEC 27001:2022 is important for organizations undergoing ISO 27001 certification.

As an ISO certification body, we understand how these major updates to standards can make things a bit complicated for you, and that’s why, in this article, we’ll discuss the key takeaways from relevant transition documents so that you know more of what to expect as things move forward with implementation.

What are the ISO/IEC 27001:2022 Transition Requirements?

Leading up to that publication of ISO/IEC 27001:2022, the International Accreditation Form (IAF), published a Mandatory Document (MD) in August 2022 outlining the transition requirements for migrating from ISO/IEC 27001:2013 to ISO/IEC 27001:2022.

The document addressed both accreditation bodies (ABs) and accredited certification bodies (also referred to as conformity assessment bodies (CABs)) and was made publicly available on the IAF’s website here.

The following are the main takeaways, which have now been updated and are now based on the transition requirements outlined in IAF MD 26:2023 (issue 2):

Key Takeaways from IAF MD 26:2023	Details
New technical updates	Control Set Replaced: ISO/IEC 27002:2022 controls (93 controls within newly formed Clauses 5-8) replace the current Annex A control set (114 controls within A.5-A.18). For more details, please refer to our previously recorded webinar. Minor Wording Changes to Clause 6.1.3.c-d: Removes potential wording ambiguity and outdated references to terms such as “control objectives” (which no longer exist under the updated control set structure of ISO/IEC 27002:2022). Addition of a New Subclause 6.3 (Planning for Changes): Defines that changes to an ISMS by an organization shall be conducted in a planned manner. *The above bullets do not represent a comprehensive list of changes but rather those that Schellman believes to be most relevant. For a complete listing of changes from ISO/IEC 27001: 2013 to ISO/IEC 27001:2022, please refer to clause 2.2 "key changes" of IAF MD 26:2023).
Transition period for certified organizations	There will be a three-year (36-month) transition period for organizations that are currently ISO 27001 certified, which began once ISO/IEC 27001:2022 was published. However, there was an important update in IAF MD 26:2023: The above three-year transition period does not apply to organizations who will be conducting a recertification review during this transition period; rather, those organizations must now start that recertification review against the ISO/IEC 27001:2022 no later than 18 months from the last day of the publication month of ISO/IEC 27001:2022 (4/30/2024). So, you can do your recertification review against the ISO/IEC 27001:2013 version of the standard provided that your recertification review is started on or prior to April 29, 2024. You would then need to transition your ISO/IEC 27001:2013 certification to ISO/IEC 27001:2022 on or before October 31, 2025 (as noted below). Aside from those circumstances, the hard deadline for the recertification against ISO/IEC 27001:2013 will be 36 months from the last day of the publication month of ISO/IEC 27001:2022 (10/31/2025).
Transition period for organizations not yet certified	As per IAF MD 26:2023, organizations that are not yet certified but are looking to become certified during the transition period will not be able to initiate an initial certification review against the ISO/IEC 27001:2013 version of the standard after April 30, 2024 (18 months following the publication of ISO/IEC 27001:2022). In other words, organizations not yet certified have until April 29, 2024, to initiate their initial certification review (e.g., Stage 1 review) against the ISO/IEC 27001:2013, otherwise, beginning April 30, 2024, all initial certification reviews must be conducted against ISO/IEC 27001:2022. (This represents a 6-month increase from the original timelines contained in issue 1 of IAF MD 26, which only gave 12 months.)
Certification Expiration	All certifications based on ISO/IEC 27001:2013 will expire or be withdrawn at the end of each respective transition period.
Transition period for accreditation bodies	Accreditation bodies will have 12 months from the last day of the publication month of ISO/IEC 27001:2022 (i.e., a deadline of October 31, 2025) to transition the accreditations of their change advisory boards (CABs), enabling them to perform certification audits of their ISO/IEC 27001:2013 certified clients.
Transition Audits	Transition audits can occur either in conjunction with an already scheduled surveillance/recertification review or in a separate audit. Assuming the transition audit objectives can still be met, transition audits can be performed remotely. This transition audit shall include the following (at a minimum): Gap analysis of ISO/IEC 27001:2022, as well as the need for changes to the client’s information security management system (ISMS) Updates to the statement of applicability (SOA) Updates to the risk treatment plan (if applicable) The implementation of the new or changed controls chosen by clients as applicable per their SOA (as well as assessment of their effectiveness) Per IAF MD 26:2023: When the transition is carried out in conjunction with a recertification review, an additional one half (0.5) auditor day will be needed to confirm the transition of the certified client. When the transition is conducted during either a surveillance audit or a separate audit, a full additional day (1.0) will become necessary. If the transition audit is successfully completed, the certificate document will be updated to reflect conformance with ISO/IEC 27001:2022; however, the expiration date of the current certification cycle will not be changed.

Learning More About ISO/IEC 27001:2022

Though we’re not on the playground anymore, the green light has been given—now, organizations can and are streaking towards the “finish line” that is a successful transition to the new version of ISO 27001.

Thanks to IAF MD 26:2022 and subsequent updates in IAF MD 26:2023, some transition requirements have been outlined that can help you take any necessary internal steps to prepare.

As you get going in your preparation, make sure you’re all caught up there by reading our other content on the changes contained within the new standard:

Should you have any questions regarding what will be an important shift to the ISO landscape, please feel free to contact our team so that we can help you address any concerns you have during this pre-launch period.

About DANNY MANIMBO

Danny Manimbo is a Principal with Schellman based in Denver, Colorado. As a member of Schellman’s West Coast / Mountain region management team, Danny is primarily responsible for leading Schellman's AI and ISO practices as well as the development and oversight of Schellman's attestation services. Danny has been with Schellman for 10 years and has over 13 years of experience in providing data security audit and compliance services.