Your Roadmap to ISO 27001:2022 Certification
ISO 27001:2022 certification takes most organisations 3 to 6 months: scope your ISMS, run a gap analysis and risk assessment, implement controls, then pass a two-stage external audit to receive a certificate valid for 3 years.
If you held a certificate under the older 2013 edition, note that it is no longer valid, the transition window closed on 31 October 2025, and recertification now requires a full initial audit.
Achieving ISO 27001:2022 certification gives your organisation a globally recognised, independently audited proof that information security is managed properly, covering risk assessment, access control, incident response, and continuous improvement. This roadmap provides a clear, step-by-step guide for planning, implementing, auditing, and maintaining an Information Security Management System (ISMS) aligned with the current 2022 standard, whether this is your first certification or a recertification.
Organisations that previously held a certificate against the earlier ISO 27001:2013 edition should note that the transition window to the 2022 edition closed on 31 October 2025, and 2013-based certificates are no longer valid. If that applies to you, see the recertification section below for what changes.
Why ISO 27001:2022 Certification Matters
Proof of a Managed Security Programme
Certification is independently audited evidence that your information security is actively managed, not just documented, giving customers and regulators a basis for trust.
Vendor and Procurement Requirements
Enterprise clients, government tenders, and many RFPs now list current ISO 27001 certification as a baseline requirement before a vendor relationship can proceed.
Built for the Current Threat Landscape
The 2022 edition reorganised Annex A into four themes and added explicit coverage for threat intelligence and cloud security, reflecting how organisations actually operate today.
A Structured Path to Maturity
The certification process itself, gap analysis, risk treatment, documented controls, internal audit, forces a level of security discipline that pays off well beyond the audit.
Recertifying After the 2013 Transition Deadline
The transition period from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 closed on 31 October 2025. Certificates still held against the 2013 edition are no longer valid, and certification bodies can no longer issue or extend them.
If Your 2013 Certificate Lapsed
A transition audit is no longer available. You will need a full initial certification audit against the 2022 edition, covering the complete Stage 1 and Stage 2 process described in the roadmap below. This takes longer than a transition audit would have, so if vendor contracts or tenders reference your certification status, it is worth starting the process promptly.
If your organisation is already certified against the 2022 edition, or is pursuing ISO 27001 for the first time, this does not affect you. The roadmap below is the standard path either way.
Roadmap at a Glance
Ten steps take most organisations from initial scoping to a certified, maintained ISMS. Each is covered in detail below.
| Step | What You Do | Key Deliverable |
|---|---|---|
| 1 | Plan ISMS and define scope | Scope Statement and Project Plan |
| 2 | Conduct a gap analysis against ISO 27001:2022 | Gap Analysis Report |
| 3 | Perform risk assessment and treatment | Risk Register and Treatment Plan |
| 4 | Implement Annex A controls | Control Implementation Records |
| 5 | Develop documentation and policies | ISMS Manual, SoA, Procedures |
| 6 | Raise awareness and train staff | Training Logs and Campaign Materials |
| 7 | Run internal audits and management reviews | Audit Reports and Review Minutes |
| 8 | Get audit-ready | Pre-audit Checklist |
| 9 | Pass the certification audit | ISO 27001:2022 Certificate |
| 10 | Maintain and improve the ISMS | Surveillance Reports and PDCA Records |
The 10-Step Roadmap Explained
Plan Your ISMS and Define Scope
Secure top-management backing before starting. Appoint a project sponsor, allocate budget, and assemble the team that will drive the certification.
Define exactly which processes, data stores, and business units fall inside the ISMS scope, and which do not. A clear boundary set early prevents scope creep and audit surprises later.
Conduct a Gap Analysis
Compare your current controls against ISO 27001:2022’s Clauses 4 to 10 and the reorganised Annex A, identifying every mismatch between what exists today and what the standard requires.
Score each gap by risk severity so remediation effort goes to the highest-risk issues first rather than being spread evenly across everything.
Perform Risk Assessment and Treatment
Identify the assets, threats, and vulnerabilities across your defined scope, then score each risk by likelihood and impact using an ISO 27005-aligned methodology to build a formal Risk Register.
Select controls from Annex A to treat each risk, and record every inclusion and exclusion with justification in the Statement of Applicability, a mandatory certification document.
Implement Annex A Controls
Technical controls include encryption, multi-factor authentication, role-based access management, and network segmentation for critical systems.
Organisational controls include documented incident response playbooks, change management checks built into development pipelines, and ongoing vetting of third-party suppliers. Controls need to run inside everyday workflows to hold up under audit, not exist only on paper.
Develop Documentation and Policies
Core mandatory documents include the ISMS Manual, Information Security Policy, Risk Assessment and Treatment Plan, and Statement of Applicability.
Maintain a central evidence repository throughout the process, audit logs, training attendance records, incident reports, and corrective action records, since auditors will expect to see this evidence organised and accessible.
Raise Awareness and Train Staff
Run company-wide security awareness activities covering the controls introduced under the 2022 edition, so staff understand what changed and why.
Supplement this with role-specific workshops for IT, HR, legal, and risk teams, since each function faces different security scenarios and needs training tailored accordingly.
Internal Audits and Management Reviews
Run an internal audit programme in line with Clause 9.2 to test whether controls actually work and surface any non-conformities before the external audit does.
Hold regular management reviews covering audit findings, current risk status, and resourcing needs, giving leadership a consistent check on the ISMS’s health.
Get Audit-Ready
Choose a certification body accredited for ISO 27001:2022, evaluating their credentials, audit approach, and experience in your sector before committing.
Run a mock Stage 1 audit internally to confirm every required document exists, controls are implemented, and evidence is ready, so nothing is a surprise on the real audit day.
Certification Audit
Stage 1, Documentation Review: the auditor examines your ISMS manual, Statement of Applicability, policies, and procedures for completeness.
Stage 2, On-Site Assessment: the auditor verifies controls in practice through staff interviews, system checks, and evidence review. Passing both stages results in your ISO 27001:2022 certificate, valid for three years.
Maintain and Improve the ISMS
Annual surveillance audits confirm that controls remain effective between certification cycles, with a full recertification audit required every three years.
Apply a Plan-Do-Check-Act cycle throughout, using incident learnings, audit feedback, and stakeholder input to continually strengthen the ISMS rather than treating certification as a one-time project.
ISO 27001:2022 Certification With CyberSapiens: Compliance and Security Services
CyberSapiens supports organisations through each phase of ISO 27001 certification, whether this is a first certification or a recertification after a lapsed 2013 certificate, with expert-led guidance and end-to-end assistance throughout.
Readiness Assessment: evaluate current information security practices to identify what’s working and what needs improvement.
Detailed Gap Analysis: compare existing controls against ISO 27001:2022 requirements to identify missing elements.
Risk Assessment and Treatment Planning: identify key risks and develop strategic plans to manage and mitigate them.
Policy and Procedure Development: customisable, ISO-compliant documentation tailored to your organisation’s structure.
ISMS Implementation Support: practical, hands-on help designing and deploying your Information Security Management System.
Security Awareness and Employee Training: equip your team with the knowledge to work within ISO 27001 standards day to day.
Internal Audit and Corrective Action Support: review readiness and implement improvements before the certification audit.
External Audit Assistance: professional guidance through to a smooth, successful certification audit.
Continuous ISMS Monitoring: ongoing reviews and proactive system monitoring to keep controls effective between audits.
Clients Served by CyberSapiens
FAQs: Your Roadmap to ISO 27001:2022 Certification
1. What’s the main difference between ISO 27001:2013 and ISO 27001:2022?
The 2022 edition reduced Annex A from 114 controls in 14 domains to 93 controls in four themes, and added 11 new controls such as threat intelligence, cloud services security, data masking and secure coding. It also added a clause on planning changes to the ISMS and aligned the wording with other ISO management system standards.
2. Can newcomers pursue ISO 27001:2022 directly?
Yes, and they should, because certification bodies can no longer certify against the 2013 edition. New applicants start with the 2022 requirements and the 93 Annex A controls.
3. How long does certification usually take?
Most organisations need 3 to 6 months, from scoping and gap analysis through to the two-stage certification audit. Your timeline depends on your scope, how mature your controls already are and how quickly gaps are closed.
4. What if my ISO 27001:2013 certificate lapsed?
The transition period ended on 31 October 2025, so 2013 certificates are no longer valid and a transition audit is no longer available. You need a full initial certification audit, covering Stage 1 and Stage 2, against ISO/IEC 27001:2022, so start promptly if customer contracts or tenders rely on your certificate.
5. How do I set a smart ISMS scope?
Base your scope on your business goals, the requirements of interested parties such as customers and regulators, and the systems and processes that handle your most sensitive information. Document clear boundaries and the reason for any exclusions, because auditors will check both.
6. What is a Statement of Applicability?
The Statement of Applicability is a mandatory document that lists each of the 93 Annex A controls, whether it applies to you, why, and its implementation status. Auditors use it as a map of your ISMS, so it must match your risk assessment.
7. How long is an ISO 27001 certificate valid?
A certificate is valid for three years, with annual surveillance audits in years two and three. A recertification audit at the end of the cycle renews it for the next three years.
8. Who issues the ISO 27001 certificate?
An accredited certification body issues the certificate after the Stage 1 and Stage 2 audits. A consultant prepares you but does not issue it, and in Australia you can check a body’s accreditation on the JAS-ANZ register.
