How to Prepare for ISO/IEC 27001:2022

New technical updates

• Control Set Replaced: ISO/IEC 27002:2022 controls (93 controls within newly formed Clauses 5-8) replace the current Annex A control set (114 controls within A.5-A.18). For more details, please refer to our previously recorded webinar.
• Minor Wording Changes to Clause 6.1.3.c-d: Removes potential wording ambiguity and outdated references to terms such as “control objectives” (which no longer exist under the updated control set structure of ISO/IEC 27002:2022).
• Addition of a New Subclause 6.3 (Planning for Changes): Defines that changes to an ISMS by an organization shall be conducted in a planned manner.

*The above bullets do not represent a comprehensive list of changes but rather those that Schellman believed to be most relevant. For a complete listing of changes from ISO/IEC 27001:2013 to ISO/IEC 27001:2022, please refer to clause 2.2 “key changes” of IAF MD 26:2023)

Transition period for certified organizations

• There will be a three-year (36-month) transition period for organizations that are currently ISO 27001 certified, which began once ISO/IEC 27002:2022 was published.
• However, there was an important update in IAF MD 26:2023: The above three-year transition period does not apply to organizations who will be conducting a recertification review during this transition period; rather, those organizations must now start that recertification review against the ISO/IEC 27001:2022 no later than 18 months from the last day of the publication month of ISO/IEC 27001:2022 (4/30/2024).

So, you can do your recertification review against the ISO/IEC 27001:2013 version of the standard provided that your recertification review is started on or prior to April 29, 2024.You would then need to transition your ISO/IEC 27001:2013 certification to ISO/IEC 27001:2022 on or before October 31, 2025 (as noted below).

• Aside from those circumstances, the hard deadline for the recertification against ISO/IEC 27001:2013 will be 36 months from the last day of the publication month of ISO/IEC 27001:2022 (10/31/2025).

Transition period for organizations not yet certified

• As per IAF MD 26:2023, organizations that are not yet certified but are looking to become certified during the transition period will not be able to initiate an initial certification review against the ISO/IEC 27001:2013 version of the standard after April 30, 2024 (18 months following the publication of ISO/IEC 27001:2022).
• In other words, organizations not yet certified have until April 29, 2024, to initiate their initial certification review (e.g., Stage 1 review) against the ISO/IEC 27001:2013, otherwise, beginning April 30, 2024, all initial certification reviews must be conducted against ISO/IEC 27001:2022. (This represents a 6-month increase from the original timelines contained in issue 1 of IAF MD 26, which only gave 12 months.)

Certification Expiration

All certifications based on ISO/IEC 27001:2013 will expire or be withdrawn at the end of each respective transition period.

Transition period for accreditation bodies

Accreditation bodies will have 12 months from the last day of the publication month of ISO/IEC 27001:2022 (i.e., a deadline of October 31, 2025) to transition the accreditations of their change advisory boards (CABs), enabling them to perform certification audits of their ISO/IEC 27001:2013 certified clients.

Transition Audits

• Transition audits can occur either in conjunction with an already scheduled surveillance/recertification review or in a separate audit.
• Assuming the transition audit objectives can still be met, transition audits can be performed remotely.
• This transition audit shall include the following (at a minimum):
  • Gap analysis of ISO/IEC 27001:2022, as well as the need for changes to the client’s information security management system (ISMS)
  • Updates to the statement of applicability (SOA)
  • Updates to the risk treatment plan (if applicable)
  • The implementation of the new or changed controls chosen by clients as applicable per their SOA (as well as assessment of their effectiveness)
  • Per IAF MD 26:2023:
    • When the transition is carried out in conjunction with a recertification review, an additional one half (0.5) auditor day will be needed to confirm the transition of the certified client.
    • When the transition is conducted during either a surveillance audit or a separate audit, a full additional day (1.0) will become necessary.

If the transition audit is successfully completed, the certificate document will be updated to reflect conformance with ISO/IEC 27001:2022; however, the expiration date of the current certification cycle will not be changed.