The formal transition from ISO/IEC 27001:2013 to the 2022 edition is over. The International Accreditation Forum set the transition period in its mandatory document IAF MD 26, and it ended on 31 October 2025. Accredited certificates to the 2013 edition are no longer valid after that date.
That does not mean every ISMS made the move in substance. Many organizations transitioned under deadline pressure: they renumbered the Statement of Applicability, passed a transition audit, and left the rest of the ISMS as it was. Others built their ISMS from templates written for 2013 and never noticed. The leftovers surface in surveillance audits, in customer reviews, and in internal audits that compare documents against the current text.
This article covers what changed between the editions, where 2013 material tends to hide, and a short check you can run on your own ISMS.
If your certificate was not transitioned
If your organization held a 2013 certificate and did not complete a transition audit before the deadline, that certificate has lapsed. There is no longer a transition route to take. Talk to your certification body about what it needs from you; in most cases you should expect an audit against the 2022 edition before a new certificate can be issued.
If you are certifying for the first time, none of the transition rules apply to you. They matter only if you are inheriting documents, templates, or a consultant's toolkit written for 2013.
What changed in clauses 4 to 10
The management system clauses changed less than Annex A did, but the changes are real and each one can produce a finding.
4.2 Interested parties. A new item c) requires you to determine which of the interested parties' requirements will be addressed through the ISMS.
4.4 Information security management system. The ISMS now explicitly includes the processes needed and their interactions.
6.2 Information security objectives. Objectives must now be monitored, and be available as documented information.
6.3 Planning of changes. New. Changes to the ISMS must be carried out in a planned manner.
7.4 Communication. The 2013 item on the processes by which communication is effected was replaced with a requirement to determine how to communicate.
8.1 Operational planning and control. You must establish criteria for your processes and control them against those criteria. The 2013 reference to outsourced processes became a requirement to control externally provided processes, products, or services relevant to the ISMS.
9.2 and 9.3. Internal audit and management review were split into subclauses. Management review gained a new input: changes in the needs and expectations of interested parties relevant to the ISMS.
10.1 and 10.2. The order swapped. Continual improvement is now 10.1, and nonconformity and corrective action is 10.2.
Separately, Amendment 1 to ISO/IEC 27001:2022, published in 2024, added climate change to clause 4. You must determine whether climate change is a relevant issue, and consider whether interested parties have climate-related requirements.
What changed in Annex A
Annex A was restructured, not edited.
From 114 controls to 93. Most 2013 controls survive, many merged with others. For example, the three 2013 logging controls (event logging, protection of log information, and administrator and operator logs) became one control, 8.15 Logging.
From 14 domains to four themes. Organizational (5), people (6), physical (7), and technological (8). The Annex A themes article explains what goes in each.
Control objectives are gone from Annex A. The 2013 edition grouped controls under stated objectives. The 2022 edition lists controls only, and ISO/IEC 27002:2022 gives each a purpose instead.
11 new controls. These include 5.7 Threat intelligence, 5.23 Information security for use of cloud services, 8.9 Configuration management, 8.12 Data leakage prevention, and 8.28 Secure coding.
Attributes. ISO/IEC 27002:2022 tags each control with attributes such as control type and cybersecurity concept. These are optional.
Annex B of ISO/IEC 27002:2022 contains correspondence tables between the 2022 and 2013 controls, in both directions. Use it as your mapping source, rather than a third-party spreadsheet whose accuracy you cannot check.
Where 2013 leftovers hide
A transition audit samples. It does not read every document. These are the places 2013 material most often survives.
The Statement of Applicability
The control list may be current while the justifications still describe 2013 controls. A merged control, such as 8.15 Logging, needs a justification that covers everything the merged control now asks, not the text of one of its predecessors.
Policies and procedures
Policies that cite control numbers such as "A.9.2.3" or "A.12.4.1" are an easy tell. More subtle are policies written against 2013 objectives, which may not cover what the merged or new 2022 controls require.
The risk register
Risks mapped to 2013 control references, or treatment plans that name controls that no longer exist, break the trace from risk to control that auditors follow. The Statement of Applicability guide covers how that trace should work.
The new controls
The 11 new controls are where thin transitions show most. A control marked "implemented" with no procedure and no evidence is a finding waiting to happen. Threat intelligence, configuration management, and monitoring activities are the usual examples, because many teams do the work informally and never wrote it down.
The management system clauses
Teams often treated the transition as an Annex A exercise. Check whether your interested parties register records which requirements the ISMS addresses, whether your objectives are monitored, and whether you have a way to plan changes to the ISMS under 6.3.
A check you can run
Set aside a few hours with the current text of both standards. Work through it in this order.
Search your documents for 2013 references. Look for "A." followed by a number, "ISO/IEC 27001:2013", and "ISO/IEC 27002:2013". Each hit is either historical and labeled as such, or something to update.
Compare your Statement of Applicability with Annex A line by line. All 93 controls listed, current titles, justifications that match the 2022 wording.
Walk the merged controls. Use Annex B of ISO/IEC 27002 to find each 2022 control that absorbed several 2013 controls. Confirm your implementation covers all of them.
Test the new controls. For each of the 11, find the procedure, the owner, and a recent piece of evidence. If any of the three is missing, it is a gap.
Check the clause changes. Confirm each item in the clause list above has a home in your ISMS: 4.2 c), 6.2 monitoring, 6.3, 8.1 criteria, and the new management review input.
Check clause 4 for climate change. Record whether it is a relevant issue, with a reason. The clause 4 article covers the context requirements in full.
Raise what you find as internal findings. Track them through corrective action, so the fix is on the record before your next surveillance audit.
For a summary of the current standard, see the ISO 27001 framework page.
How TrustLynce helps
TrustLynce maintains your Statement of Applicability against the 2022 Annex A, with version history, and maps each control to the evidence behind it through compliance automation. That makes a control marked implemented without evidence visible before your auditor finds it.