Consider an ISMS manager preparing for a surveillance audit after years of working with ISO/IEC 27001:2013. The policies still look familiar, but the control set, terminology, and evidence expectations now need to be reviewed against the 2022 revision.
The ISO/IEC 27001:2022 Transition Exam is designed for professionals who already understand ISO/IEC 27001 and need to demonstrate that they can interpret and apply the 2022 changes. It is most relevant for people maintaining, auditing, consulting on, or converting an information security management system from the 2013 edition to the 2022 edition.
Updated for the ISO/IEC 27001:2022 revision, this guidance focuses on the practical transition rather than treating the change as a document refresh. The official ISO/IEC 27001 information security management systems page remains the authoritative reference for the standard itself, while ISO/IEC 27002:2022 should be treated as supporting control guidance rather than a replacement for the management system requirements in ISO/IEC 27001.
What changed from ISO/IEC 27001:2013 to ISO/IEC 27001:2022
The most visible change is the restructuring of Annex A controls to align with ISO/IEC 27002:2022. The 2013 edition grouped controls differently, while the 2022 edition reflects a more current view of information security practice, including themes such as threat intelligence, cloud services, monitoring activities, data leakage prevention, data masking, secure configuration, and ICT readiness for business continuity.
That regrouping matters because many organisations built their Statement of Applicability, internal audit templates, supplier questionnaires, and evidence libraries around the older Annex A structure. A transition project therefore needs to map old controls to new ones, confirm which controls remain applicable, and update the reasons for inclusion or exclusion. The work should be driven by risk, not by a mechanical one-to-one spreadsheet exercise.
The clauses of ISO/IEC 27001 also include amendments in wording and terminology. These changes are less dramatic than the Annex A restructure, but they still matter for auditors and implementers because they affect how the ISMS is described, maintained, and evidenced. A mature transition plan checks policies, procedures, risk treatment records, internal audit criteria, and management review inputs rather than replacing every instance of “2013” with “2022”.
Who benefits from the Transition Exam
The Transition Exam is usually the right route for professionals who already have ISO/IEC 27001 knowledge and need to update it. That includes ISMS managers responsible for maintaining certification, consultants supporting clients through transition, internal auditors checking readiness, and professionals renewing ISO/IEC 27001-related credentials. It is also useful for practitioners who have been hands-on with a 2013-based ISMS and now need a focused way to validate their understanding of the 2022 changes.
It is less suitable as a first ISO/IEC 27001 qualification. Someone new to ISMS design, risk treatment, internal audit practice, or certification audit preparation will usually gain more from a broader implementer or auditor learning path before attempting a transition-focused exam. The transition route assumes that the candidate already understands core concepts such as ISMS scope, risk assessment, risk treatment, the Statement of Applicability, internal audit, corrective action, and continual improvement.
- Choose the Transition Exam if the main need is to update existing ISO/IEC 27001:2013 knowledge to the 2022 edition.
- Choose a full implementer path if the main responsibility is designing or leading an ISMS from the ground up.
- Choose a full auditor path if the main responsibility is planning, conducting, or leading ISMS audits.
- Delay certification study if the immediate need is operational remediation; the ISMS evidence should be corrected before exam preparation becomes the priority.
This distinction avoids a common mistake: using the Transition Exam as a substitute for foundational ISMS competence. The exam can validate knowledge of the revision, but it does not remove the need to understand how risk management, control selection, performance evaluation, and improvement work in a live management system.
How to transition an ISMS without creating a paper-only update
A credible transition begins with the business context and risk picture. The organisation should re-run or refresh its information security risk assessment in light of current assets, services, suppliers, technology use, and threat conditions. This is especially important where the 2013-era ISMS pre-dated major cloud adoption, remote working practices, expanded supplier dependencies, or new monitoring capabilities.
The Statement of Applicability should then be updated against the 2022 Annex A structure. This is where many transition projects become weak: the control mapping is completed, but the justification for applicability is left unchanged. A stronger approach reviews why each control is needed, what risk it addresses, where the evidence sits, who owns it, and whether existing implementation still meets the organisation’s risk appetite.
Confirm the current ISMS scope, interested parties, assets, suppliers, and business processes.
Refresh the risk assessment before finalising control applicability decisions.
Map ISO/IEC 27001:2013 Annex A controls to the 2022 Annex A structure.
Update the Statement of Applicability with current justifications and control ownership.
Review policies, procedures, records, monitoring outputs, and audit criteria for consistency.
Phase evidence updates before the next surveillance or recertification audit.
In practice, this sequencing helps avoid audit stress because it separates risk thinking from document editing. If the organisation first updates the SoA and only later revisits risk, the transition can become circular: controls appear selected before the risk rationale has been refreshed. Reassessing risk first makes the updated SoA easier to defend during internal and external audits.
One anonymised example illustrates the point. A mid-sized services organisation with an established 2013-based ISMS began by mapping old Annex A controls to the 2022 structure, but its internal audit found that cloud supplier oversight and monitoring evidence were scattered across procurement, IT operations, and security tooling. The team paused the document update, reassessed risks linked to hosted services and privileged access monitoring, clarified ownership, and then updated the SoA with stronger evidence references before the surveillance audit. The outcome was a cleaner audit trail and fewer last-minute evidence requests.
Applying the new and updated control themes
The 2022 revision is easier to understand when the control themes are treated as operational work. Cloud services governance, for example, should lead to clearer supplier assessment, shared responsibility decisions, access review expectations, data location considerations, and incident notification requirements. A transition that only adds “cloud services” to a policy misses the point if procurement, architecture, legal, and operations do not know what evidence they are expected to maintain.
Threat intelligence also needs careful interpretation. It does not necessarily require an expensive platform, but it does require a defined way to collect, assess, and act on relevant threat information. For some organisations that may mean reviewing vendor advisories, sector alerts, vulnerability information, and incident lessons through an agreed process. For others, it may include more formal intelligence feeds and security operations workflows. The control should be proportionate to risk and useful to decision-making.
Data masking and data leakage prevention create similar implementation challenges. The transition team should identify where sensitive information appears in production, testing, reporting, analytics, support, and collaboration tools. It should then decide what masking, access restriction, monitoring, or leakage prevention measures are appropriate. The evidence is likely to sit across data owners, system administrators, developers, and security operations, so ownership needs to be explicit.
Monitoring activities are another area where organisations can overstate maturity. Logs may exist, but the audit question is often whether monitoring is planned, reviewed, tuned, escalated, and retained in a way that supports the organisation’s risk treatment. Evidence may include monitoring rules, alert triage procedures, incident tickets, review records, or management reporting. A useful transition turns those activities into repeatable control evidence rather than relying on informal assurance.
How to prepare for the ISO/IEC 27001 Transition Exam
Preparation should be centred on the changes introduced by the 2022 edition. Candidates who already know ISO/IEC 27001 should spend less time revising generic ISMS concepts and more time understanding revised terminology, clause amendments, Annex A restructuring, and how ISO/IEC 27002:2022 informs control interpretation. The exam code referenced in the original certification route is ISO27001TR, and candidates should always verify current scope, registration requirements, and certificate application steps with PECB before booking.
Scenario practice is particularly useful because the transition is rarely a memory exercise in real organisations. A candidate may be asked to recognise how an old control maps to a new control theme, what evidence would support a revised SoA entry, or how an auditor should respond when a policy has been updated but operational records have not. Implementers should practise decisions about risk treatment and evidence ownership, while auditors should practise assessing whether the transition has been embedded in the ISMS rather than confined to controlled documents.
Common pitfalls include treating the transition as a rename project, skipping risk recalibration, leaving supplier and cloud governance outside the ISMS update, and failing to brief control owners before an audit. Another frequent weakness is updating the SoA without changing internal audit criteria, which leads to audits that still test the old structure. These issues are preventable when the transition plan includes risk review, control mapping, evidence ownership, and audit planning from the start.
Some professionals prefer structured preparation when they need to move from standard changes to exam readiness. The Readynez ISO/IEC 27001 Transition training course is one option for candidates who want guided coverage of amended clauses, terminology, Annex A differences, and the practical work involved in moving from a 2013-based ISMS to ISO/IEC 27001:2022.
Planning the next step
The ISO/IEC 27001:2022 transition is most effective when it connects exam preparation with real ISMS improvement. A professional preparing for the Transition Exam should be able to explain the structural changes, apply them to risk treatment and the SoA, and recognise weak evidence during audit preparation. An organisation preparing for audit should be able to show that the 2022 revision has been reflected in risk assessment, control ownership, operational records, and continual improvement.
The most practical next step is to compare current responsibilities with the decision guidance above. If the goal is to update existing ISO/IEC 27001 knowledge and support a live transition, the Transition Exam is a focused route. If the goal is broader ISMS implementation or audit leadership, a wider certification path may be more appropriate. To discuss training options or timing, readers can contact Readynez for guidance without treating certification as a substitute for the underlying ISMS work.
