ISO 27001:2022 transition checklist for organisations still on 2013

What changed in ISO 27001:2022 and why it matters for SMEs

If your organisation is still working to ISO 27001:2013, the transition to the 2022 version is not something to leave until the last minute. For a small or medium-sized business, the real risk is not just extra admin. It is the cost of rushed document updates, unclear ownership, and avoidable gaps in the way your information security management system works day to day.

The good news is that this is usually an update, not a rebuild. If your current system already reflects how your business operates, the transition should focus on making sure your scope, risk decisions, controls, and evidence still make sense under the newer structure. A practical approach keeps disruption low and helps leadership see what has changed, why it changed, and who is responsible.

For many SMEs, the transition is also a useful reset. It is a chance to remove outdated paperwork, confirm that controls still match the business, and make sure the system is understandable to the people who actually run it. If you are also reviewing how your wider compliance work fits together, it can help to compare this exercise with your existing priorities, such as the trade-offs discussed in ISO 27001:2022 vs Cyber Essentials Plus.

The practical difference between the 2013 and 2022 versions

The 2022 version keeps the same overall idea: build and maintain a managed approach to information security. What changes is the structure of the control set and the way some expectations are grouped. That means your existing controls may still be valid, but they may need to be mapped differently, renamed, or supported with clearer evidence.

In plain terms, you are checking three things:

• Whether your current controls still cover the risks your business faces.
• Whether the way you describe those controls still matches the 2022 structure.
• Whether your records show that the controls are actually in use, not just written down.

What a transition means for your current ISMS

Your information security management system, often shortened to ISMS, should already be tied to the way your business works. The transition should therefore be treated as a controlled change. That means reviewing the current position, updating what needs updating, and checking that the revised system still supports business operations, customer expectations, and internal accountability.

If you have not recently revisited the basics of scope, it is worth doing that before you touch the rest of the documentation. A clear starting point makes every later step easier. Our guide on ISMS scope definition for small organisations is useful background if you need to tighten that part up first.

Before you start: confirm your current position

Before making changes, establish what version your ISMS is built around and what evidence supports it. This sounds simple, but many SMEs discover that their documents, spreadsheets, and policies have drifted over time. One team may be using an old version of a policy, while another is working from a more recent risk register. That creates confusion and wastes time.

Check which version your ISMS is built around

Confirm whether the current system was designed against the 2013 version, whether any parts have already been updated, and whether any customer commitments or internal targets refer to the newer version. You are looking for a clear baseline. Without it, you cannot tell what has genuinely changed and what is just old wording.

List the documents, controls, and evidence that may need review

Build a simple inventory of the items that could be affected. For most SMEs, that list should include:

• Scope statement.
• Risk assessment and treatment plan.
• Statement of Applicability, which is the document that explains which controls apply and why.
• Policies and procedures.
• Evidence records, such as training logs, access reviews, backup checks, and incident records.
• Internal audit notes and management review records.

This is also a good point to identify the people who own each item. If no one can explain a document, it is unlikely to be maintained properly.

Step 1: review your scope and business context

Scope is one of the most common weak spots in a transition. Businesses change quickly. You may have added a new office, moved more services into the cloud, outsourced support, or started handling new types of customer data. If your scope no longer reflects reality, the rest of the ISMS will be built on shaky ground.

Make sure the scope still matches how the business operates

Check whether your current scope still covers the people, systems, services, and locations that matter. If the business has grown, contracted, or changed direction, the scope may need to be narrowed or expanded. The aim is not to make the scope as broad as possible. The aim is to make it accurate enough that your controls and evidence are meaningful.

Identify any new systems, locations, suppliers, or services

Look for anything that has changed since the last full review:

• New software platforms or hosted services.
• New suppliers that store or process information for you.
• New office locations or remote working arrangements.
• New customer-facing services or products.
• Changes in who can access key systems.

If any of these changes affect how information is protected, they should feed into the transition work. Supplier and service changes often create hidden risk, so it is worth checking those carefully. If third parties are a major part of your operating model, our article on third-party cyber risk assessments for SMEs may help you tighten that review.

Step 2: update your risk assessment and treatment plan

The transition is a sensible time to refresh your risk assessment. You do not need to start from scratch if your current assessment is still useful, but you should check whether the assumptions behind it are still true. A risk that was acceptable two years ago may no longer be acceptable if your business has changed, your customer base has grown, or your technology stack has shifted.

Look for new or changed risks since the last review

Focus on what has changed in the business, not just on abstract cyber threats. For example:

• Has remote access increased?
• Are more staff using personal devices?
• Has a supplier taken on a more critical role?
• Are you storing more sensitive information than before?
• Have any systems reached end of life or become harder to support?

These are the kinds of changes that can quietly increase exposure and make old treatment decisions less reliable. If you need a refresher on the basics, our guide to risk assessment and treatment under ISO 27001 explains the practical approach in more detail.

Decide whether existing treatments still make sense

For each important risk, ask whether the current treatment is still the right one. Sometimes the answer will be yes. In other cases, the control may still exist but the way it is applied needs to change. For example, a manual approval step may no longer be realistic if the business has doubled in size. Or a policy may be fine, but the supporting process may be too informal to prove it is working.

Keep the treatment plan realistic. Small organisations often do better with a few well-run controls than with a long list of controls that nobody follows consistently.

Step 3: map your current controls to the 2022 Annex A structure

One of the most useful transition tasks is to map your existing controls to the updated control structure. This is not about rewriting every control. It is about understanding where your current arrangements sit in the new structure and whether anything has been missed.

Group existing controls against the updated control themes

Take your current control set and sort it into the new themes. As you do this, look for:

• Controls that clearly still apply but may need a new label or location.
• Controls that overlap and could be simplified.
• Controls that exist in practice but are not clearly documented.
• Areas where the business has changed but the control set has not kept up.

This exercise is often where SMEs find the most value. It can reveal duplicated work, outdated wording, or controls that were never properly owned. It also helps leadership see that the transition is about clarity and consistency, not just compliance language.

Spot gaps, overlaps, and controls that need clearer ownership

When you map the controls, do not stop at the document level. Check who is responsible for each control, how often it is reviewed, and what evidence shows it is operating. If a control has no owner, it is unlikely to be maintained. If two teams think the other one is responsible, the control may be missed entirely.

For organisations that want a more structured way to compare control sets, our article on mapping ISO 27001 Annex A controls to NIST 800-53 may be useful as a reference point, even if you are not using that framework directly.

Step 4: refresh the Statement of Applicability

The Statement of Applicability is one of the most important documents in the transition. It shows which controls apply, which do not, and why. For a small business, this document should be easy to read and easy to defend internally. If it is vague, inconsistent, or out of date, it will create problems later.

Check which controls apply and why

Review each control and confirm whether it is still relevant to your business. Where a control is not applicable, record a clear reason. Where a control is applicable, make sure the wording matches what you actually do. Avoid generic statements that do not explain the real situation.

Record any changes in a way that is easy to explain internally

The best Statement of Applicability documents are practical, not decorative. They help managers, IT staff, and business owners understand why a control exists and how it supports the business. If the document is too technical or too long, people stop using it. Keep it concise, but make sure the reasoning is clear.

If you need a more detailed walkthrough of this document, our Statement of Applicability walkthrough for first-time implementers is a useful companion piece.

Step 5: update policies, procedures, and supporting records

Not every document needs a full rewrite. In fact, one of the most common mistakes is spending too much time polishing documents that staff rarely use. Focus first on the documents that shape day-to-day behaviour and the records that prove the system is working.

Prioritise the documents people actually use

Start with the policies and procedures that affect access, incident handling, supplier management, backup, change control, and staff awareness. If a document is outdated but never used, it is less urgent than a document that staff rely on every week. The aim is to reduce confusion and make the system easier to run.

Our guide to policies and procedures required by ISO 27001 can help you decide which documents deserve attention first.

Avoid rewriting everything if only a few areas have changed

Keep the work proportionate. If the business has only changed in a few areas, update those areas and leave the rest alone where it still works. Overwriting stable documents creates unnecessary risk because it introduces new wording, new approvals, and new chances for inconsistency.

Supporting records matter just as much as the documents themselves. If a policy says something happens, there should be evidence that it does. That might include training records, access reviews, supplier checks, incident logs, or backup test results.

Step 6: collect evidence that the updated controls are working

Evidence is what turns a written system into a credible one. For SMEs, the best evidence is usually simple and operational. You do not need elaborate reports if you can show that the control is being used consistently and reviewed at sensible intervals.

Use practical examples from day-to-day operations

Look for evidence that already exists in normal business activity. Examples include:

• Completed access review records.
• Training attendance or completion records.
• Backup test results.
• Supplier review notes.
• Incident tickets or post-incident actions.
• Change approvals for important systems.

If you already use a governance, risk, and compliance tool, you may be able to automate some of this collection. If not, a well-organised shared folder and a simple tracker can still work, provided the records are current and easy to find. For more detail, see automating ISO 27001 evidence collection using GRC tools.

Keep evidence simple, current, and easy to retrieve

Evidence should answer three questions quickly: what happened, when did it happen, and who is responsible. If it takes half an hour to find a basic record, the system is too hard to operate. Build a structure that lets you retrieve evidence without a scramble when a customer asks for reassurance or when you carry out an internal check.

Step 7: brief staff and assign owners for the transition work

A transition fails when it is treated as a document exercise owned by one person. The practical reality is that information security touches leadership, operations, IT, and often external suppliers. Everyone involved needs to know what changed and what they are expected to do.

Make responsibilities clear across IT, operations, and leadership

Assign owners for the main workstreams. For example, one person may own the risk register, another the policies, another the evidence tracker, and another the management review process. Keep it simple and visible. If ownership is unclear, tasks drift and deadlines slip.

Use short awareness sessions rather than one-off announcements

Do not rely on a single email. Short briefings work better because they give people a chance to ask questions and understand what has changed. Focus on the practical impact: what staff need to do differently, what managers need to check, and what evidence needs to be kept.

Step 8: test readiness before you treat the transition as complete

Before you close the transition, run a final internal check. This does not need to be a formal exercise, but it should be structured enough to show whether the updated system is coherent. The purpose is to catch weak spots early, while they are still easy to fix.

Run an internal check against the updated ISMS

Walk through the updated scope, risks, controls, documents, and evidence. Ask whether each part makes sense on its own and whether the pieces fit together. Check that the wording in the Statement of Applicability matches the risk treatment plan and the actual controls in use. Check that evidence is recent, not just historical.

If you already run internal audits, use that process to test the transition. Our article on internal audits under ISO 27001 is a useful reference for what to look at.

Fix weak spots before any external review or customer challenge

Even if you are not preparing for an external assessment right away, customers may still ask questions about your security management. A clean transition gives you a stronger answer. It shows that the business knows what changed, has reviewed the impact, and has kept the system under control.

Common transition mistakes SMEs should avoid

Most transition problems are avoidable. The most common mistake is treating the update as a paperwork exercise. That leads to documents being changed without checking whether the business process behind them has also changed. Another common mistake is leaving ownership unclear, which means no one is accountable for keeping the system current.

Other issues to watch for include:

• Updating the Statement of Applicability without checking the risk assessment.
• Keeping old evidence structures after the control set has changed.
• Rewriting documents that staff do not use, while ignoring the ones they do.
• Failing to brief managers and staff on what changed.
• Assuming the transition is complete because the documents look tidy.

If your organisation is also thinking about how ISO 27001 fits alongside other frameworks or customer demands, it may help to step back and compare priorities rather than trying to satisfy everything at once. That is often where sensible trade-offs save time and money.

A simple 30, 60, 90-day transition plan

For many SMEs, a phased plan is the easiest way to keep the work manageable. You do not need a large project team. You need a clear sequence and regular check-ins.

What to do first

In the first 30 days, confirm the current version of your ISMS, review the scope, and list the documents and evidence that need attention. Then identify the main business changes since the last review. This gives you the baseline for the rest of the work.

What to complete before the final review

By day 60, aim to have the risk assessment, treatment plan, control mapping, and Statement of Applicability updated. By day 90, finish the document refresh, collect current evidence, brief staff, and complete an internal readiness check. If anything is still unclear at that point, resolve it before you call the transition finished.

Final thoughts

The ISO 27001:2022 transition should be treated as a practical housekeeping exercise with business value. Done well, it improves clarity, reduces wasted effort, and makes it easier to explain your security position to customers and staff. For UK SMEs, that is often more useful than a large, complicated programme.

If you want help turning the checklist into a realistic plan for your organisation, Speak to a consultant.

Frequently asked questions

What is the difference between ISO 27001:2013 and ISO 27001:2022?

The main difference for most SMEs is the updated control structure and the need to review whether existing controls, documents, and evidence still fit the newer version. It is usually an update to the current system rather than a complete rebuild.

Do we need a full new set of policies and procedures to move to ISO 27001:2022?

Usually not. Most organisations only need to update the documents that are affected by changes in scope, risk, controls, or evidence. The best approach is to refresh what is outdated and leave stable documents alone.

How should a small organisation approach the transition if time is limited?

Use a phased plan. Confirm your current position, review scope and risk, map controls, refresh the Statement of Applicability, then update the most important policies and evidence first.

What evidence should we keep during the transition?

Keep practical records that show the controls are working, such as access reviews, training records, backup tests, supplier checks, incident logs, and change approvals. The evidence should be current and easy to retrieve.