Notifications
Clear all
Topic starter
08/06/2026 4:30 pm
TL;DR: ISO 27001:2022 keeps the same ISMS backbone but raises the stakes for organisations that have not completed the 2013-to-2022 migration by 31 October 2025, according to Teleport. The practical issue is not certification paperwork alone, but whether identity, access, and audit evidence can prove control effectiveness under modern cloud and access patterns.
NHIMG editorial — based on content published by Teleport: ISO 27001:2022 Requirements Explained for 2025
By the numbers:
- Organizations certified to ISO 27001:2013 must complete their transition to ISO 27001:2022 by 31 October 2025 to maintain certification.
Questions worth separating out
A: They should start by mapping scope, access ownership, and audit evidence to the controls that actually operate in production.
Q: What breaks when ISO 27001 access controls exist on paper but not in daily operations?
A: The ISMS becomes difficult to defend because auditors test effectiveness, not intent.
Q: How do security teams know whether their ISO 27001 controls are actually working?
A: They should look for evidence that controls produce measurable outcomes, such as timely revocation, complete audit trails, and consistent ownership records.
Practitioner guidance
- Map the ISMS scope to identity control boundaries Define the systems, cloud platforms, and administrative domains that actually generate access risk, then ensure the scope statement matches those boundaries and not just organisational charts.
- Build audit evidence from live identity operations Collect access logs, certificate issuance and revocation records, ownership assignments, and review outcomes in a form that can be reproduced during certification and surveillance audits.
- Tie each Annex A control to a named risk owner For every selected control, document who owns the control, which risk it addresses, and what operational evidence proves it is working in day-to-day use.
What's in the full article
Teleport's full blog covers the operational detail this post intentionally leaves for the source:
- Clause-by-clause examples of what auditors expect in each part of the ISMS, including documentation and effectiveness evidence.
- The article's control mapping for Annex A changes in 2022, including where access, monitoring, and configuration controls fit.
- Teleport's examples of how short-lived certificates and centralised access can support ISO 27001 evidence collection.
- The source's own implementation framing for compliance teams that need to move from policy to operational proof.
👉 Read Teleport's guide to ISO 27001:2022 requirements for 2025 →
ISO 27001:2022 in 2025: what IAM teams need to recheck?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
08/06/2026 6:11 pm
ISO 27001 compliance now depends on whether identity evidence is operational, not decorative. The standard still asks for scope, leadership, planning, monitoring, and improvement, but auditors care about whether those clauses are backed by living identity controls. That makes access governance and certificate traceability central to certification outcomes, especially in cloud-heavy environments. Practitioners should treat ISMS evidence as an identity data problem as much as a documentation problem.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when ISO 27001 certification is at risk because migration is delayed?
A: Leadership remains accountable because ISO 27001 requires governance, resourcing, and performance oversight, not just technical implementation. The ISMS owner, CISO, and business leaders all need to ensure scope, controls, and evidence are aligned before certification expiry. Delayed migration is therefore a governance failure as much as a technical one.
👉 Read our full editorial: ISO 27001:2022 compliance in 2025 is an identity problem
