Answer
Does ISO 27007 expire my ISO 27001 certificate?
No. ISO/IEC 27007 is guidance for auditing an ISMS, not a certifiable requirement standard. A certificate is issued against ISO/IEC 27001, and a new edition of 27007 does not end it. The certification body sets any transition rule for the audits it runs.
The certificate is against ISO/IEC 27001, not 27007
The certificate names ISO/IEC 27001 as the requirement standard. ISO/IEC 27007 tells an audit team how to run an ISMS audit. A new edition of the guidance changes the method and the annex rows, not the requirement the certificate was issued against.
What a certification body may do
A certification body applies ISO/IEC 27006-1 and ISO/IEC 17021-1, and its accreditation body sets the rules for its own transition. The 27007 revision does not create a transition period. If a body chooses to update its audit programme to the new guidance, that is a decision inside its own system, not a condition on the certificate.
What does change
The audit criteria may change if the organisation moves to ISO/IEC 27001:2022 or if its certification body updates the audit programme. The Statement of Applicability may need to move to the 2022 control set. The internal audit programme may need its 2013 references updated. Those are programme changes, not certificate expiry.
What to tell the board
Say plainly: the guidance is being revised, no certificate expires, the audit programme will be reviewed, and the review has a date and an owner. Do not present the planning date as a deadline. It is an estimate from the ISO stage.
Where to check
The ISO page for the DIS records the stage and the life cycle. The ISO page for the 2020 edition records that it is expected to be replaced. The 27007 pages on this site separate the two.
Read next
Not legal advice; does not certify. The record date is 2026-10-19. Check the sources on the revision record.