ISO 27001 2013 certificate expired? What to do now the transition has closed

What expired on 31 October 2025

If your ISO 27001 2013 certificate expired because the move to the new edition was not finished in time, you are not alone, and the position is recoverable. The rules came from IAF MD 26, the mandatory document that set the transition for accredited certification bodies. It allowed 36 months from the end of the month in which ISO/IEC 27001:2022 appeared, which put the cut-off at 31 October 2025. From 30 April 2024, every initial and recertification audit already had to use the 2022 edition.

Accredited bodies were required to move their certified clients to the third edition by that date. Certificates that had not been transferred expired or were withdrawn when the period ended. JTC 1/SC 27, the ISO/IEC subcommittee responsible for the standard, put it plainly: after October 2025, every valid ISO/IEC 27001 certification must reference the 2022 edition. An expiry date printed further in the future does not rescue a 2013 certificate, because the edition itself is no longer one that accredited certification can be held against.

In practice, this means three things. You cannot present the organisation as ISO/IEC 27001 certified until a new certificate is issued. A buyer who checks the certification body's register or IAF CertSearch will find no current certificate for you. And any contract, tender response or questionnaire that promised continuing certification now needs attention.

Which situation are you in?

The right first step depends on how the certificate came to lapse and who is relying on it. The table sorts the common cases.

What the 2022 edition changes for a lapsed ISMS

The management system clauses 4 to 10 kept their shape, so policies, roles, internal audit, management review and corrective action built for 2013 are rarely wasted. The work sits mainly in the controls and in the documents that connect risks to controls.

A regrouped control set

Annex A moved from 114 controls in 14 clauses to 93 controls in four themes: organisational, people, physical and technological. IAF MD 26 counts 11 new controls, 24 formed by merging older ones and 58 updated. The new ones include threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, data leakage prevention, monitoring activities and secure coding. Our guide to Annex A by theme explains each group.

The documents that must be rewritten

IAF MD 26 named what a transition audit had to cover: a gap analysis against the 2022 edition, any changes the ISMS needed, an updated Statement of Applicability and an updated risk treatment plan. Those same items are the heart of your recovery. A Statement of Applicability still listing 114 controls, or a treatment plan pointing to 2013 control numbers, will not survive an audit.

Amendment 1:2024

Published in February 2024, the amendment asks you to determine whether climate change is a relevant issue in your context and notes that interested parties may hold climate-related requirements. It is small, but the 2022 audit will expect to see it considered in the context analysis.

The route back to a valid certificate

Treat recovery as a short, disciplined project with a fixed end date, not as paperwork. The sequence below works whether the ISMS has kept running or has drifted.

1. Confirm the position with the certification body

Ask the body that issued the 2013 certificate, in writing, what it now requires: whether it will treat you as a new client, how many audit days it will plan under ISO/IEC 27006-1, and its earliest dates. If you change bodies, check its accreditation first; our guide to choosing an ISO/IEC 27001 certification body sets out the checks, including recognition of its accreditation body through Global ACI, which replaced the IAF MLA on 1 January 2026.

2. Measure the ISMS against the 2022 edition

A gap analysis compares what still operates with clauses 4 to 10 and the 93 controls, and separates the reusable from the missing. The gap analysis guide describes what it examines and what you receive.

3. Refresh the risk assessment and remap the controls

Re-run the risk assessment with current assets, suppliers and cloud services, decide treatment, compare the chosen controls with the new Annex A and produce a fresh Statement of Applicability and treatment plan that the risk owners approve.

4. Build the evidence the new controls produce

Controls such as monitoring, configuration management and data leakage prevention need records: logs reviewed, baselines approved, alerts handled. Those accumulate only with time, which is why the evidence period, not the writing, sets the pace.

5. Audit internally, review, then face the external audit

Run an internal audit covering the clauses and the new controls, hold a management review that records decisions, close your own findings and then go to the certification body. The certification process guide covers the stages from there.

Customers, tenders and contracts in the gap

The commercial exposure usually hurts more than the audit. Enterprise customers re-check certificates at renewal, and procurement teams can search the public databases themselves. A supplier found presenting a lapsed certificate loses trust that a straightforward explanation would have kept.

• Stop using the 2013 certificate and mark. Remove it from the website, proposals, e-mail signatures and security portals.
• Review your commitments. List contracts and framework agreements that require current ISO/IEC 27001 certification and note any notice obligations.
• Write one accurate statement. Explain that the ISMS continues, that certification to the 2022 edition is in progress, and give the planned audit window once the certification body has confirmed it.
• Answer questionnaires accurately. Where a form asks for a current certificate, say that one is not held today and offer the gap analysis summary or the internal audit results as interim evidence, where the customer accepts them.
• Watch tender deadlines. Some tenders accept evidence of work in progress and some do not; check each one rather than assuming.

Mistakes to avoid while you recover

A lapsed certificate invites shortcuts, and each one costs more later.

• Renumbering instead of reassessing. A spreadsheet that maps old control numbers to new ones is a useful aid, but the Statement of Applicability must follow a genuine risk treatment, not a lookup table.
• Accepting a certificate in days. An offer to issue a 2022 certificate within a week or two, without Stage 1 and Stage 2, is a warning sign, and the result will fail the first customer who checks the accreditation.
• Letting the ISMS stop while you wait. Access reviews, incident handling and supplier assessments that pause during the gap leave holes in the evidence the auditor will sample.
• Changing scope silently. If services, sites or cloud platforms have changed since the 2013 audit, rewrite the ISMS scope before the body plans its audit days.

Expired ISO/IEC 27001:2013 certificates: questions buyers ask