IAF ConsultancyIf you are asking whether to get ISO 27001 certification, the first question is not whether. It is which version. ISO 27001:2013 certificates expired on 31 October 2025. Only ISO 27001:2022 is issued now. A project scoped against the old edition is a project that cannot end in a valid certificate.
Why Does the Version Matter Before You Decide?
Because the version decides what you have to build. The 2022 edition restructured Annex A into four themes: organisational, people, physical, and technological. It added controls around threat intelligence, cloud services, and supplier relationships. It also tightened requirements on planning changes and business continuity.
If your gap assessment, your policies, or your consultant's template pack still reference the 2013 control numbers, the work will have to be redone. That is not a certification problem. It is a scope problem, and it is cheaper to catch it now.
What Should You Check Before Committing?
- Does the proposal name ISO 27001:2022 explicitly, or just "ISO 27001"?
- Does the risk assessment method match the 2022 requirements, including how you select controls from Annex A?
- Is there a Statement of Applicability that lists every Annex A control with a justification for inclusion or exclusion?
- Does the plan cover supplier and cloud controls, which the 2022 edition treats more directly?
If any of those are missing, the answer to "should I get certified" is still maybe. The answer to "is this project set up correctly" is no.
Does the Version Change Whether Certification Is Worth It?
Not really. The business case is the same as it has always been: clients and procurement teams ask for evidence that information security is managed, not improvised. What changes is the effort. The 2022 edition asks for a more current view of risk, which means the system has to reflect how you actually work with cloud providers, remote access, and third parties.
That is more work up front. It is also a more honest system. A 2013-era ISMS built around an on-premise server room does not describe most businesses now.
How Do You Start?
Certification with IAF Consultancy begins with an application. The offer names the scope, the audit days, and the price. Stage 1 reviews the documented system. Stage 2 samples it in operation. When the audit supports certification, an accredited certification body issues the certificate. IAF Consultancy does not issue it. The sequence is described in how certification works.
If you have already started down this road, the more useful question may be what happens after the certificate arrives. That is covered in after the certificate.