Worth an hour

The supplier certificates that expired quietly in October 2025

There is an hour of work sitting in most organisations’ supplier folders, and almost nobody has done it.

ISO/IEC 27001:2022 was published in October 2022, and the transition rules gave existing certificate holders three years to move. That window closed on 31 October 2025. Certificates issued against the 2013 edition stopped being valid on that date, whoever issued them and however long they had left to run.

Which means any supplier assurance pack assembled before late 2025 and not revisited since contains certificates that are now expired by definition rather than by date.

Why this is easy to miss

A certificate does not change appearance when the edition behind it is withdrawn. It still has a logo, a number, a scope and an expiry date that may well be in the future. If nobody reads the standard number, nothing looks wrong.

The organisations most exposed are the ones that did supplier assurance properly the first time. They collected certificates, filed them, recorded the expiry dates, and set reminders against those dates. The reminder fires when the certificate says it expires — which, for a 2013-edition certificate, is not when it actually stopped meaning anything.

The three checks

For each certificate in the folder:

Which edition does it name? If it says ISO/IEC 27001:2013, it is expired regardless of the date printed on it. Ask the supplier for their current one.

Is it current? The ordinary expiry check. Certificates run three years with surveillance audits in between, and a suspended or withdrawn certificate does not announce itself to you.

Does the scope cover what you actually buy from them? This is the one that finds the most problems and gets checked the least. A certificate scoped to a supplier’s UK operations does not cover the service delivered from elsewhere. A certificate scoped to one product line says nothing about the other product you use. The scope is printed on the certificate for exactly this reason.

Why an auditor cares

If you are certified yourself, this is not housekeeping. It is a control.

The supplier relationship controls in Annex A ask you to manage information security risk in your supply chain and to monitor and review supplier service delivery. A folder of certificates nobody has examined is the visible evidence of a control that is documented but not operating, and that distinction is exactly what a Stage 2 or surveillance auditor is trained to find.

The awkward version of this conversation goes: you present the supplier register, the auditor picks one supplier, asks to see the assurance evidence, and the certificate produced names a withdrawn edition of the very standard being audited. It is a small finding with an unhelpful amount of symbolism attached.

While you have the folder open

Two other things are worth checking at the same time, because you will not open it again for a year.

Is the certificate accredited? An accredited certificate comes from a body assessed by a national accreditation body and carries an accreditation symbol and number you can resolve against a register. A non-accredited one comes from a body nobody has assessed. Both look like certificates.

Do you have anything at all for your most critical suppliers? Most registers are complete for the suppliers who volunteered a certificate and thin for the ones who did not. The second group is usually more interesting.

None of this is difficult. It is an hour, once a year, and the calendar entry is better set against your own management review than against the dates printed on other people’s paperwork.

All notes · Cost calculator · ISO 27001 consultants