2013-version certificates lapsed in October 2025; 93 controls and four themes.
The 2022 version of the ISO/IEC 27001 information security management standard was published in October 2022 and the three-year transition period ended on 31 October 2025. No certificate issued to the 2013 version is valid any longer. If you still hold a certificate to the old version you need to go through a certification audit against the new version. In this article we summarise what changed.
Annex A: from 114 controls to 93
The 14 clauses and 114 controls of the 2013 version were reduced to 93 controls in four themes in the 2022 version:
- Organisational controls: 37
- People controls: 8
- Physical controls: 14
- Technological controls: 34
Many controls were merged and 11 new ones added.
New controls
- Threat intelligence
- Information security for the use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
Fine adjustments in the main clauses
There is no structural change in clauses 4 to 10, but new sub-clauses were added for the requirements of interested parties, planning and monitoring of processes, measurement criteria and planning of changes. The inputs of the management review were updated.
What should the SoA look like now?
The Statement of Applicability must show for each control whether it is applied, the justification and the implementation status, and the list must match the 2022 theme structure. Statements prepared with the old Annex A numbering are not accepted at audit.
Practical suggestions
- Map your existing risk treatment plan to the new controls and identify missing ones
- Create a supplier evaluation record for your cloud use
- Write a data deletion and masking policy and collect evidence
- Sample the new controls in the internal audit
If your certificate was issued by Miyar Belgelendirme you can check its status with the certificate verification tool on our site. For an information security audit it is enough to fill in the quote form.
Common findings at audit
The most common findings in transition audits are: lack of evidence for the new controls (cloud security, information deletion, data masking); supplier assessments that are out of date; weakly written control justifications in the SoA; an internal audit that does not cover the new controls; and responsible-person and date fields left empty in the risk treatment plan.
Planning the timeline
If you have still not transitioned, you need to complete the conformity gap analysis within four weeks at the latest and then apply for an audit date. The audit can be completed within a few weeks at most between stage 1 and stage 2; remote and hybrid audit options shorten the time.
Keeping the certificate valid
A new-version certificate is not issued until major nonconformities found in the audit are closed. Applying to a tender or customer with an expired certificate can count as a breach of contract, so plan your timeline early.