ISO/IEC 27001:2022 Transition Deadline: What Happens If You Miss It
Organizations certified under the 2013 version had a hard deadline, set by the International Accreditation Forum, to move to the 2022 controls. Here's what a missed transition actually means.
October 21, 2026
v1
2 min
ISO/IEC 27001:2022 Transition Deadline: What Happens If You Miss It
ISO/IEC 27001:2022 replaced the 2013 version's 114 controls across 14 domains with 93 controls across 4 themes. The International Accreditation Forum set a transition deadline for existing 2013-certified organizations to move to the new Annex A structure through their normal surveillance or recertification audit cycle.
What happens if an organization misses it
A certification body cannot issue or maintain a valid ISO 27001 certificate against a withdrawn standard version past the transition deadline. In practice this means the organization's certificate lapses — a real, visible gap in a vendor-security posture that enterprise buyers and auditors will notice.
- Confirm your certification body's own transition audit schedule — most build the Annex A 2022 update into your next scheduled surveillance audit.
- The gap analysis between 2013 and 2022 controls is real work, not paperwork — several 2022 controls (cloud security, threat intelligence, data masking) didn't exist in the 2013 version at all.
Explore ISO 27001
Hub overview →
Related Executive Guides
A practitioner's guide to the ISMS, the 2022 Annex A restructure, the certification process, and what actually changed from the 2013 version.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.