Announcement on Arrangements for Transition to ISO/IEC 27001:2022 Certification Standard
Dear Valued Clients,
Thank you for your trust and support in choosing Kaixin Certification (Beijing) Co., Ltd. (hereinafter referred to as KCB) for your certification services.
The International Organization for Standardization (ISO) released ISO/IEC 27001:2022 "Information Security, Cybersecurity and Privacy Protection - Information Security Management Systems - Requirements" (hereinafter referred to as the new standard) in October 2022. This standard replaces ISO/IEC 27001:2013 (hereinafter referred to as the old standard) as the basis for information security management system certification. The China National Accreditation Service for Conformity Assessment (CNAS), in accordance with the International Accreditation Forum (IAF) requirements outlined in IAF MD 26:2023 (2nd edition), issued two documents: CNAS-EC-066:2022 "Explanation on the Transition of ISO/IEC 27001:2022 Certification Standard" and CNAS-SC170:2017 "Accreditation Scheme for Bodies Providing Audit and Certification of Information Security Management Systems." In accordance with the relevant requirements of CNAS and IAF, KCB will carry out the transition to the ISO/IEC 27001:2022 certification standard.
The following are the relevant requirements for the certification standard transition:
1. Certification Standard Transition Timeline
1) The transition period for ISO/IEC 27001 is 36 months from the last day of the month of the standard's release, i.e., until October 31, 2025. Certificates issued under the old standard must be transitioned to the new standard by this date. From November 1, 2025, certificates issued under the old standard that have not been transitioned will automatically become invalid and will be uniformly reported for revocation. Clients who have not completed the transition may apply for certification as a new audit.
2) From September 1, 2023, the company will start accepting certification applications based on the new standard and will conduct audits accordingly.
3) To protect the interests of our clients, KCB will no longer accept certification applications based on the old standard from April 30, 2024. All initial certification audits and recertification audits will be conducted based on the new standard. Certificate changes and surveillance can continue based on the old standard, but since certificates issued under the old standard will become invalid on October 31, 2025, clients are advised to evaluate the potential impact and make appropriate arrangements.
2. Client Preparation for Certification Transition
1) Develop and implement a plan for transitioning to the new standard.
2) Study and research the new standard to identify differences between the old and new standards in their application within the organization.
3) Train or inform all departments involved in the effectiveness of the management system about the changes in the standard.
4) Update the existing management system according to the new standard to ensure continuous compliance and effectiveness.
5) Conduct at least one internal audit and management review based on the new standard before the external audit.
6) After completing the above preparations, submit a written transition application to KCB along with the required documents to prepare for the audit.
3. Certification Transition Methods and Related Work Arrangements
1) During the transition period, KCB will implement the certification standard transition in conjunction with annual surveillance or recertification audits based on the client's preference. Clients may also opt for a special on-site audit, which will require additional audit time:
· When the transition audit is combined with a recertification audit, at least 0.5 auditor days will be required.
· When the transition audit is conducted separately or combined with a surveillance audit, at least 1.0 auditor days will be required (the specific number of auditor days will be determined based on the actual project situation).
2) Upon audit and certification decision, new standard certification certificates will be issued/reissued to clients who meet the new standard requirements.
Note: Before KCB obtains the conclusion of the CNAS transition review, certification certificates without the accreditation mark will be issued to certified clients. After obtaining the conclusion of the CNAS transition review, certification certificates with the accreditation mark will be issued within the scope of accreditation.
Transition certificates must comply with the above provisions and all relevant requirements of the national certification and accreditation administration and accreditation bodies.
If you have any questions during the implementation of the standard transition, please contact KCB. We will provide you with support and services.
This is hereby announced.
Kaixin Certification (Beijing) Co., Ltd.
June 30, 2023