ISO 27001:2022 in Bangladesh: Why 2013 Certificates Are No Longer Valid and How to Get Certified

Banks, telecoms, government buyers and foreign clients increasingly ask Bangladeshi companies one question in tenders and vendor reviews: "Are you ISO 27001 certified?" Since late 2025 there is a follow-up question: "To the 2022 edition?"

The 2013 edition has expired

ISO/IEC 27001:2022 was published on 25 October 2022. The International Accreditation Forum (IAF) gave certified organisations a three-year transition period. Under that guidance:

• from 30 April 2024, new certifications and recertifications had to be made against the 2022 edition;
• on 31 October 2025, all ISO/IEC 27001:2013 certificates expired or were withdrawn.

An organisation with an expired 2013 certificate is treated as a new client and needs a full initial audit. If a supplier still shows a 2013 certificate in 2026, it is no longer valid.

How to check a certificate in two minutes

1. Ask for the certificate number and the certification body.
2. Check that the standard is ISO/IEC 27001:2022 and the expiry date is in the future.
3. Check the scope — a certificate for "training services" does not cover a company's software or data centre.
4. Confirm the certification body is accredited (for example by a member of IAF) and verify the certificate on its website or registry.

What changed in ISO 27001:2022

• Annex A was reorganised from 114 controls in 14 domains to 93 controls in 4 themes: organisational, people, physical and technological.
• 11 new controls were added, including:
  • threat intelligence;
  • information security for use of cloud services;
  • ICT readiness for business continuity;
  • physical security monitoring;
  • configuration management;
  • information deletion;
  • data masking;
  • data leakage prevention;
  • monitoring activities;
  • web filtering;
  • secure coding.
• The management-system clauses were aligned with other ISO standards, including clearer planning of changes.

Steps to certification

1. Define the scope — which business units, locations, systems and services the ISMS covers.
2. Gap assessment against the 2022 clauses and Annex A.
3. Risk assessment and risk treatment plan, and a Statement of Applicability listing which of the 93 controls apply.
4. Implement controls and write policies — access control, supplier security, incident management, backup, secure development and more.
5. Train staff and run awareness sessions.
6. Internal audit and management review.
7. Certification audit by an accredited certification body:
   • Stage 1: documentation review;
   • Stage 2: implementation audit.
8. Surveillance audits every year and recertification every three years.

Most small and mid-sized organisations take roughly 4–9 months from start to certificate, depending on scope and how mature their existing controls are.

Where ISO 27001 meets local requirements

• Bangladesh Bank Cybersecurity Framework, Version 1.0 (2026): its controls are described as mostly based on ISO 27001, so an ISMS covers much of the groundwork for banks, MFS and payment providers.
• Personal data protection: Bangladesh's new personal data protection law expects appropriate technical and organisational security measures that are tested regularly. An ISMS gives you a documented way to show that.
• Card payments: if you store, process or transmit card data, you need PCI DSS v4.0.1 as well. ISO 27001 does not replace it.

How Byte Capsule can help

Byte Capsule IT is ISO 27001 certified itself, and our team includes ISO 27001 Lead Auditors. We help organisations with gap assessments, risk assessments, policies, internal audits and certification readiness. Our penetration testing provides the technical evidence auditors ask for.

See our ISO 27001 and security audit services or book a free consultation.

Sources: ISO/IEC 27001:2022; IAF transition guidance for ISO/IEC 27001:2022 (transition ended 31 October 2025); Bangladesh Bank Cybersecurity Framework, Version 1.0 (2026).