ISO 27001:2022 transition deadline: October 31, 2025. Already passed. Certs still on the 2013 version aren't valid. Here's what Annex A 5.9 and 8.8 actually require, and how 1 SBOM covers both: https://anchore.com/blog/one-sbom-five-auditors/