ISO/IEC 27001:2022 Transition Deadline: What Happens If You Miss It

ISO/IEC 27001:2022 replaced the 2013 version's 114 controls across 14 domains with 93 controls across 4 themes. The International Accreditation Forum set a transition deadline for existing 2013-certified organizations to move to the new Annex A structure through their normal surveillance or recertification audit cycle.

What happens if an organization misses it

A certification body cannot issue or maintain a valid ISO 27001 certificate against a withdrawn standard version past the transition deadline. In practice this means the organization's certificate lapses — a real, visible gap in a vendor-security posture that enterprise buyers and auditors will notice.

1. Confirm your certification body's own transition audit schedule — most build the Annex A 2022 update into your next scheduled surveillance audit.
2. The gap analysis between 2013 and 2022 controls is real work, not paperwork — several 2022 controls (cloud security, threat intelligence, data masking) didn't exist in the 2013 version at all.