New Version of ISO/IEC 27001:2022

CYBER AND INFORMATION SECURITY: In October 2022, ISO/IEC 27001 was revised. After the end of the conversion phase, every certification must be based exclusively on the new revision ISO/IEC 27001:2022 – all existing ISO/IEC 27001:2013 certificates will then lose their validity.

In the document IAF MD 26 of 15 February 2023 (IAF Mandatory Document), the "International Accreditation Forum" (IAF) set out a three-year transition period and certain transitional precautionary measures. This means that after the end of the conversion phase, every certification according to ISO 27001 may be based only on the new edition, and all certificates according to the old edition will become invalid – regardless of the expiry date information in the certificate.

On 1 January 2023, the German National Accreditation Body (DAkkS) published conversion guidelines for accreditations in the field of ISO/IEC 27001:2022.

Every initial certification and recertification audit starting from 1 May 2024 must be carried out according to the new version ISO/IEC 27001:2022. The starting point is the first day of the on-site audit (Stage 1 audit). All certification decisions for the transition of an existing ISO/IEC 27001:2013 certification must be completed by 31 October 2025 at the latest. Otherwise, a new full initial certification must be carried out.

Conversion audits must include an additional on-site audit period. This additional duration is carried out once and relates exclusively to the conversion audit.

The following measures are recommended for an organisation managing an ISMS based on ISO/IEC 27001:2013:

• Identify organisational gaps that need to be addressed in order to meet the new requirements.
• Create a conversion plan.
• Appropriate training and awareness-raising of all parties affecting the effectiveness of the organisation.
• Adapt the existing ISMS to meet the changed requirements and provide evidence of effectiveness.

For any further questions, the T-Cert team is at your disposal!