ISO 27001:2013 to 2022: what the transition deadline means for vendor certificates

ISO/IEC 27001:2022 replaced the 2013 edition on 25 October 2022. The International Accreditation Forum gave certified organisations thirty-six months to transition under IAF MD 26, and the window closed on 31 October 2025. Any certificate that still cites ISO/IEC 27001:2013 has expired or been withdrawn under accredited certification, whatever printed expiry date it carries. This explainer covers what changed, how to read a certificate that claims the new edition, and where public evidence exists at all.

96,709

valid ISO/IEC 27001 certificates worldwide

ISO Survey 2024, covering 179,877 sites

31 Oct 2025

End of the IAF transition period

IAF MD 26; 2013-edition certificates expire or are withdrawn

93

Annex A controls in the 2022 edition

Down from 114 in the 2013 edition

All certificates based on ISO/IEC 27001:2013 shall expire or be withdrawn by the end of the transition period.

What changed in the 2022 edition

The management system clauses changed little: minor alignment with the harmonised structure and a new clause 6.3 on planning of changes. The visible change is Annex A, which follows ISO/IEC 27002:2022. The 114 controls in 14 domains became 93 controls in four themes: organisational, people, physical and technological. Eleven controls are new, including threat intelligence, information security for cloud services, data leakage prevention, monitoring activities, web filtering and secure coding. Twenty-four were merged and fifty-eight updated.

How to read the certificate

1. 1

   Edition

   It must say ISO/IEC 27001:2022. A 2013 certificate is expired for accredited purposes since 31 October 2025.

2. 2

   Certification body and accreditation

   The CB’s name and the accreditation body’s mark. An unaccredited "certificate" is a consultancy letter. CertReports links certification bodies to their auditor pages.

3. 3

   Scope statement

   The ISMS scope names products, services, locations and sometimes teams. A scope that covers "the corporate IT function" says nothing about the product you buy.

4. 4

   Sites

   Multi-site certificates list the covered locations. Check the one that processes your data.

5. 5

   Surveillance

   A certificate is valid on paper for three years but depends on annual surveillance audits. A lapsed surveillance invalidates it without changing the printed expiry, which is why CertReports reads status and withdrawal separately from the expiry date where a registry provides them.

Why vendor pages lag

Trust centres are often edited by marketing, so a certificate PDF uploaded in 2023 stays online. Badge widgets say "ISO 27001 certified" with no edition, which is never wrong and never useful. Some vendors transitioned but published only the new expiry date and left the old document linked as the evidence. The index still finds 2013 certificates on live trust centres nearly a year after the deadline; the index note has the pattern.

The market behind the certificates

The ISO Survey 2024 counted 96,709 valid ISO/IEC 27001 certificates covering 179,877 sites, nearly double the 48,671 reported for 2023. Part of the jump is methodological, since the 2024 survey draws on the IAF CertSearch database directly, but the direction is clear and consistent with a 20 percent compound growth rate across the decade. China holds the largest national count at 33,359. For a buyer the number matters less than the lookup: there is no crawlable global registry, and IAF CertSearch allows individual checks but not bulk access.

Where public evidence exists

Because there is no bulk registry, most ISO 27001 evidence on CertReports is vendor-stated (a certificate or badge published by the vendor) or verified by auditor (the certification body confirms it). The edition rule is the one check a buyer can apply to a vendor-published certificate without calling anyone. Browse vendors with public ISO 27001 evidence on the ISO 27001 hub; rows still citing the 2013 edition are flagged expired, and expiring this month lists certificates approaching their printed date.