IAF MD 26 – Transition from DIN EN ISO/IEC 27001:2017 to ISO/IEC 27001:2022

The publication of ISO/IEC 27001:2022 has meant, and continues to mean, that organisations already certified have had to carry out a transition to ISO/IEC 27001:2022.

For the transition process to ISO/IEC 27001:2022, the IAF defined requirements in MD 26:2023 which both the accreditation bodies (such as the German Accreditation Body, DAkkS) and the certification bodies (such as RSM Certification GmbH) must follow.

The changeover took place in a two-stage procedure. In the first step, certification bodies accredited by DAkkS had to undergo an audit by DAkkS in order to obtain new or renewed accreditation for ISO/IEC 27001:2022. This process had to be completed by October 2023.

For the process of transitioning issued certificates to ISO/IEC 27001:2022, the timeframe for organisations already certified and those newly to be certified also derives from IAF MD 26:2023. In brief, the following was established:

The transition phase is three years from the publication of ISO/IEC 27001:2022 (i.e. 24 October 2025).
From November 2023, initial certifications and recertifications may be carried out exclusively to ISO/IEC 27001:2022.
Organisations already certified to DIN EN ISO/IEC 27001:2017-06 must complete the transition to ISO/IEC 27001:2022 by 31 October 2025 at the latest if the certificate is to be maintained.
The transition can take place in conjunction with a surveillance audit, a recertification audit, or in a separate audit (hereinafter only the word "audit" is used).
The audit must not rely solely on a document review, particularly for verifying the technical controls.
The audit covers, among other things:
- the gap analysis against ISO/IEC 27001:2022 and the need for changes to the ISMS,
- updating the Statement of Applicability (SoA),
- where applicable, updating the risk treatment plan,
- the implementation and effectiveness of the new or amended controls selected by the client.
The audit can be carried out remotely, provided it can be ensured that the objectives of the audit are achieved.
Regardless of the audit format (surveillance audit, recertification audit, separate audit), IAF MD 26:2023 gives rise to additional minimum effort incurred by RSM Certification GmbH, which must be charged.
On completion of the audit, the certification documents are updated. If the audit is carried out as a separate audit and therefore only the transition was assessed, the schedule of the current certification cycle is not changed.

Surveillance audits may still be carried out to DIN EN ISO/IEC 27001:2017 until 31 October 2025, and must be completed by then.

This entry does not claim to cover all individual requirements of IAF MD 26:2023 in full. Rather, it is intended as a summary of the key requirements – particularly from a customer perspective.

Go back

IAF MD 11 – Audits of integrated management systems to ISO/IEC 17021-1

How can organisations with several management systems – for example for quality and information security – make their audit processes more efficient? The IAF MD 11:2023 guidance provides answers to the key questions on auditing integrated management systems. In our article you will learn exactly what the "degree of integration" is, how it affects audit time, and why a high level of integration can save real money. We show you which requirements conformity assessment bodies must meet, how the audit effort is calculated, and give a concrete worked example for practice. A must for anyone looking to optimise audits and avoid unnecessary duplicate assessments.

IAF MD 1 – Auditing and certification of management systems in multi-site organisations

How does certification work for organisations with multiple sites – and what needs to be considered in multi-site audits? The IAF MD 1:2023 guidance sets out clear requirements, which we examine more closely in this article. From the definition of key terms such as "head office" and "sites", through the requirements for matrix certifications, to the question of when a sampling procedure makes sense and when it does not: we provide a comprehensive overview of the factors that influence audit effort and audit duration. Discover the key prerequisites and find out how best to prepare the certification process for your multi-site organisation. An indispensable guide for organisations looking to structure their certification effort clearly.

IAF MD 2 – Certificate transfers

Would you like to transfer your certification to a new certification body? The IAF MD 2 document governs the prerequisites and requirements to be met when transferring certificates – for example for ISO 9001 or ISO/IEC 27001. In this article you will learn under which conditions a certificate transfer is possible, how the assessment process works, and what to do if certificates cannot be transferred due to particular circumstances. We also examine the role of the issuing and the accepting certification body in the transfer process and what to bear in mind after a successful transfer. An indispensable guide for organisations aiming for a smooth change of certificate.

IAF MD 4 – Use of information and communication technology (ICT) in audits

Digital technologies in audits – yes or no? IAF MD 4:2023 sets out clear rules on how information and communication technology (ICT) can be used for audit purposes and when remote delivery is possible. This article gives you an overview of the fundamental requirements a certification body must meet when audits are carried out using ICT. Find out how virtual sites are defined, which conditions apply to the use of ICT, and how factors such as security, confidentiality and procedural requirements are taken into account. A must for organisations considering ICT for more efficient audits.

IAF MD 29 – Transition to ISO/IEC 27006:2024

With the publication of ISO/IEC 27006:2024, certification bodies face an important transition. IAF MD 29 governs the changeover to this new standard for information security management systems and primarily affects certification and accreditation bodies, with no direct impact on certified organisations. Certification bodies such as RSM Certification GmbH have two years to complete the transition, from the gap analysis through to the final audit by DAkkS. Find out here which steps are needed for a successful transition to ISO/IEC 27006:2024.