Transition Guide: From ISO / IEC 27001: 2013 to ISO 27001:2022

What this ISO 27001:2022 transition guide covers

This guide sets out the procedure certified organizations followed to move an ISO/IEC 27001:2013 certificate to ISO/IEC 27001:2022. It explains the three ways a transition audit could be scheduled, what auditors examine, how audit timing and fees change, what the audit requires, and how the certification decision is made.

The 2022 version of the standard was issued in October 2022, which opened a transition period. Under IAF MD 26, certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of that period, which closed on October 31, 2025. The guide remains a reference for what the move to the 2022 version involves.

Who this guide is for

Organizations that held ISO 27001:2013 certification, and security and compliance teams that want a clear record of how the transition to ISO 27001:2022 worked, including the changes to controls, the Statement of Applicability and the risk treatment plan.

Three ways to complete a transition audit

The guide describes three options:

• During a surveillance audit, combined with the regular review of the ISMS
• During a recertification audit, as part of the broader recertification review
• As a separate transition audit, scheduled on its own and contracted separately with the certification body

Which route fits depends on the organization’s audit schedule, available resources and ISMS readiness.

On timing, adding the transition to a surveillance or recertification audit increases audit time by at least half a day, based on ISO auditor-day calculations, with a matching rise in fees. A separate transition audit requires its own contract and leaves the expiration date of the current certification cycle unchanged.

What a transition audit includes

Auditors interview personnel to see how well staff understand and apply the updated controls. They review ISMS documentation such as policies, procedures and records, and they inspect implemented controls against ISO 27001, ISO 27002 and the organization’s own policies.

The guide lists four requirements:

• A gap analysis between ISO/IEC 27001:2022 and the current ISMS, covering the 11 new controls in the 2022 version
• An updated Statement of Applicability (SoA) listing applicable controls and their implementation status, with policies updated to the new version
• A risk treatment plan updated for risks identified in the gap analysis
• An assessment of the implementation and effectiveness of new or changed controls

How the certification decision is made

The decision rests on the transition audit results and follows Compass Rose’s established certification process. The certification body reviews the audit findings and verifies conformity with ISO/IEC 27001:2022 before approving the transition. A successful transition audit results in an updated ISO/IEC 27001:2022 certificate.

The guide also notes that the transition application was due at least three months before the surveillance or recertification audit in which the transition took place, to allow time for review, scheduling and preparation.

Questions this guide answers

When did the ISO 27001:2013 transition period end?

The transition period began when the new standard was issued in October 2022 and ended on October 31, 2025. Under IAF MD 26, certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of the transition period.

How many new controls are in ISO 27001:2022?

The guide identifies 11 new controls in the 2022 version. The transition gap analysis is built to find the changes needed to address them.

Does a transition audit add time to a surveillance audit?

Yes. Based on ISO auditor-day calculations, combining the transition with a surveillance or recertification audit adds at least half a day, with a corresponding increase in fees.

Does a separate transition audit change the certification cycle?

No. A separate transition audit needs its own contract, and the expiration date of the current certification cycle stays the same.

Download the guide for the full ISO 27001:2013 to 2022 transition procedure.