31 October 2025: The End of the Transition to ISO/IEC 27001:2022
Certificates issued against ISO/IEC 27001:2013 are no longer valid after 31 October 2025. The deadline holds a lesson for every organisation that will soon face transitions in other standards.
Key points
- The three-year transition to ISO/IEC 27001:2022 ends on 31 October 2025.
- Certificates to the 2013 edition expire or are withdrawn at that date.
- Organisations that left the transition to the last months faced limited auditor availability.
What the deadline means
After 31 October 2025, only certificates to the 2022 edition are valid. An organisation whose transition is not complete has to arrange a new certification audit.
Lessons for the next transitions
- Start the gap analysis in the first year, not the last
- Train internal auditors on the new edition early, so that internal audits produce useful findings
- Combine the transition audit with a planned surveillance or recertification audit
- Allow time after the audit for closing nonconformities and for the certification decision
Why it matters beyond information security
New editions of ISO 9001 and ISO 14001 are in preparation, and food safety schemes are updated every few years. The pattern is always the same: organisations that plan early treat a transition as routine maintenance, and those that wait treat it as a crisis.