ISO 27001 Latest Version: Why 2022 is Now Mandatory and How to Catch Up
Author
Rob Hall
CEO, Tempo Audits
Key Takeaways
- ISO/IEC 27001:2022 is the current edition. The transition deadline for 2013 certificates passed on 31 October 2025.
- The 2022 update reorganised Annex A into four themes and reduced the control set from 114 to 93. Organisations should review their risks, Statement of Applicability and evidence against the revised requirements.
- Certification involves more than updating documents. Auditors assess whether the information security management system is implemented and working in practice.
What is ISO 27001 and Which Version is Current?
ISO/IEC 27001 sets out how an organisation can manage information security through a formal management system. In practice, that means identifying the information it holds, assessing the risks to it and putting suitable protections in place. For a technology company, those protections might cover access to customer data, supplier security, incident response and regular checks that controls still work as the business changes.
The current edition is ISO/IEC 27001:2022, the third edition, published in October 2022. Amendment 1:2024 adds a requirement to consider whether climate change is relevant to the organisation’s context. The 2013 edition has been withdrawn, and its certification transition period ended on 31 October 2025. Certificates based on the 2013 edition should now have expired or been withdrawn.
Why Was ISO 27001 Updated in 2022?
By 2022, cloud services, third-party platforms and modern software development had changed how many organisations handled information. The update made the standard’s controls more relevant to those day-to-day risks.
The 2022 edition reorganised Annex A from 114 controls into 93, grouped under four themes. It also introduced 11 controls covering areas such as cloud services, threat intelligence, data leakage prevention and secure coding. The changes give organisations clearer points to consider when assessing these risks. They do not mean every control applies automatically; each organisation selects controls based on its risks and records its decisions in its Statement of Applicability.
AI is not named as a specific control area in the 2022 standard. Organisations using AI tools still need to assess relevant information security risks, such as how those tools access or handle sensitive data.
The cost of a breach can be substantial. IBM’s 2026 report puts the global average at US$4.99 million (approximately £3.78 million), 12% higher than the previous year. At Tempo Audits, we assess whether an organisation’s ISMS meets ISO/IEC 27001 requirements, including whether its control decisions reflect its identified risks.
What Changed in ISO/IEC 27001:2022?
The 2022 revision changed the way Annex A controls are organised and made a couple of requirements in the main clauses more specific. Here are the changes organisations are most likely to notice:
The new Annex A list is not a checklist that every organisation must adopt in full. Control choices should follow the organisation’s risk assessment and be explained in its Statement of Applicability.
The 11 New Controls in ISO/IEC 27001:2022: What They Mean for Tech Companies
The 2022 edition groups 93 Annex A controls under four themes: organisational, people, physical and technological. Eleven controls are new. Several are especially relevant to SaaS, cloud-native and AI companies because they address cloud services, software development and the handling of sensitive information.
What Changed in the ISO/IEC 27001:2022 Clauses?
The 2022 edition kept the same overall clause structure, but it made some requirements more explicit and added a new clause on planning changes. For technology companies, these updates matter when the business changes its systems, services, suppliers or security processes.
What If Your ISO/IEC 27001:2013 Certificate Wasn’t Transitioned by October 2025?
The transition deadline was 31 October 2025. After that date, certificates based on ISO/IEC 27001:2013 had to expire or be withdrawn. There was no grace period. If your organisation did not transition, it no longer holds current accredited certification to ISO/IEC 27001:2022.
Your security controls and processes do not disappear, but customers may ask why your certificate is no longer current. If certification is required by a contract or procurement process, you may need to provide other evidence of your security arrangements until you are certified again.
You cannot complete a late transition audit. You will need to apply for certification to ISO/IEC 27001:2022 through the initial audit process: Stage 1, followed by Stage 2. An existing, active ISMS can give you a useful head start, but it still needs to meet the current requirements and be supported by up-to-date evidence.
At Tempo Audits, we’ll make sure you know what to expect at each stage, what the audit involves and what happens next. If you have questions about the certification process, you’ll have someone to speak to, so you’re not left trying to work it all out on your own.
How to Get ISO/IEC 27001:2022 Certified After the 2025 Transition Deadline
If your ISO/IEC 27001:2013 certificate expired or was withdrawn, you’ll need to follow the initial certification route. An existing ISMS gives you a foundation, but you’ll need to check it against the current requirements and show that it works in practice.
Important note - As an independent certification body, Tempo Audits can assess your ISMS, but we can’t design it, implement it or prescribe how to fix specific gaps. We will explain what each audit stage involves, what evidence we review and what happens if we raise a finding. We’ll keep you informed throughout the process and answer questions about certification.
ISO 27001:2022 FAQs
Is ISO/IEC 27001:2022 legally mandatory?
ISO/IEC 27001 certification is generally voluntary. A customer contract, procurement requirement or regulation may make it necessary for a particular organisation. If you choose to hold accredited certification, it needs to be against the current edition, ISO/IEC 27001:2022.
Does ISO/IEC 27001:2022 apply to SaaS companies?
Yes. The standard applies to organisations of any size and sector. A SaaS company defines the ISMS scope around the services, teams, systems and locations it needs to cover. The certificate then applies to that defined scope, rather than automatically covering every part of the business.
Does Amendment 1:2024 require a separate ISO 27001 certificate?
No. Amendment 1:2024 updates ISO/IEC 27001:2022; it is not a new edition or a separate certification. It adds a requirement to consider whether climate change is relevant to the organisation’s context and whether interested parties have climate-related requirements.
How long does ISO 27001 certification take?
From putting your ISMS in place to certification, the process can take around three to 12 months. Once your system is ready, we typically complete the formal audit phase for an SME in three to four weeks. The exact timing depends on your scope, audit findings and how quickly any required actions are completed.
Does ISO 27001 certification guarantee that we won’t suffer a data breach?
No. Certification shows that an organisation’s ISMS has been independently assessed against the standard within its defined scope. It does not remove every security risk or guarantee that an incident will never happen. The organisation still needs to maintain its controls, respond to changing risks and keep improving its security practices.
Rob Hall
Book a call
No forms, no faff – just a conversation and a quote. Prefer to skip straight to it? Fill out the application form and we'll get moving.
Alternatively, if you have all the details,
fill out this form here.