Free reference and checker

ISO 27007 is being revised. Know what changes in your audit programme.

The clause-by-clause record of ISO/IEC DIS 27007, the guidance standard for auditing an ISMS, read against the 2020 edition and ISO/IEC 27001:2022. It shows what applies today, what the draft moves, and what evidence to keep before the expected publication.

TodayISO/IEC 27007:2020

DraftDIS, Edition 4

Stage40.60

Planning date12 Sep 2027

Run the free edition check Read the clause record

No account, no email, no request leaves your browser. The check is computed from the record on this site.

The record at a glance

ISO/IEC DIS 27007, Edition 4, 50 pages, prepared by ISO/IEC JTC 1/SC 27. It will replace ISO/IEC 27007:2020.

Ballot opened: 30 Jun 2026
Close of voting: 23 Sep 2026
Expected publication: 2027
Planning date: 12 Sep 2027
Transition: none in 27007
Free records: 43 clauses
Annex A rows: 27

Draft, not published

The planning date is an estimate from the ISO stage, not an ISO date. Check the official record.

Three colleagues reading printed documents at a table during an audit meeting — **The work is the audit file, not the certificate.** The revision changes the guidance an audit team uses, the annex rows it tests and the competence it records. The kit gives you the register, the evidence list and a dated plan, so the change is a controlled update rather than a scramble after publication.

Free check

Which edition applies to your next audit?

Six questions, a dated answer, and three clauses to read next. The check places your audit before or after the planning date, flags 2013 dependencies in your criteria and annex rows, and tells you what to do before the next cycle. It does not score you and it does not call you compliant.

Current or draft

The 2020 edition applies until the final edition is published. The check says which one your next audit sits under.

2013 dependencies

The 2020 Annex A was written against ISO/IEC 27001:2013. The DIS moves it to 2022. The check flags the rows to review.

A dated plan

Three named actions, the stage checkpoints and the source for every date. Save the result as your programme note.

Start the free check

What changed

A technical alignment, not a new audit standard.

The DIS foreword states one main change: the document is aligned with the 19011 revision and with ISO/IEC 27001:2022/Amd 1:2024. The scope and the 5, 6 and 7 clause structure carry over from 2020. The practical work is in the references, the annex and the competence record.

THE ANNEX

Annex A moves to ISO/IEC 27001:2022

The 2020 audit-guidance rows were written against the 2013 edition. The DIS aligns them to 2022, adds 6.3 Planning of changes and swaps 10.1 and 10.2.

Read the record

THE METHOD

Remote and hybrid audits

The 19011 revision expands remote-audit guidance and folds virtual locations into remote audit. The DIS aligns to it. The audit file has to say what the method could not reach.

Read the record

THE RECORD

What actually changed

The scope and the 5, 6 and 7 structure carry over. The references move. The annex is remapped. The public DIS body is not available in full, and the site says so.

Read the record

Today, under 2020

Audit criteria can cite the 2013 or the 2022 edition
Annex A rows follow the 2013 clauses
The Statement of Applicability may still use the 114-control structure
19011:2018 is the method reference

Draft, under the DIS

Criteria align to ISO/IEC 27001:2022/Amd 1:2024
Annex A rows follow the 2022 clauses
The 2022 control set is 93 controls in four themes
ISO 19011:2026 is the method reference

The record

One record per clause and per Annex A row.

Each page states the requirement in our own words, the evidence an auditor asks for, the common gaps and the preparation that carries into the draft. Every field has a source pointer. Where the public record does not show a change, the page says so.

Six records to start with
Clause	Record	Draft treatment
4	Principles of auditing	aligned
5.2	Audit programme objectives	re-referenced
5.3	Audit programme risks	aligned
5.5.2	Objectives, scope and criteria	re-referenced
6.4.7	Collecting and verifying information	re-referenced
7.2.3	Knowledge and skills	aligned

All 43 clause records All 27 Annex A rows

What it costs

Free to read. Pay for the work.

Free

USD 0

no account

All 43 clause records
All 27 Annex A rows
The revision record and the sources
The edition check, in your browser
The labelled sample of the kit

Start reading

Revision kit

USD 799

one off, PDF, CSV, XLSX

71-row obligation register
The full evidence list, by clause
A dated plan to the planning date and the checkpoints
The 2020 to 2026 crosswalk and reference update list
Single organisation licence

Buy the kit

Change watch

USD 49

a month

The kit files while the watch is active
Email when the record or its guidance changes
Email when a stage date changes
The diff, with the source that changed
Cancel from the account page

Start the watch

Prices are charged in US dollars through Stripe. The kit is a one-off payment. The watch is a monthly subscription and includes the kit files while it is active. A kit buyer gets the regenerated files when the final standard is published, at no extra charge. Nothing is metered and there is no per-seat charge. What each includes.

Questions

What buyers ask

What is ISO/IEC DIS 27007?

It is the Draft International Standard for the fourth edition of ISO/IEC 27007, the guidance standard for auditing an information security management system. ISO records it at stage 40.60, close of voting on 23 September 2026. A draft is not a published standard. Read the revision record.

Does the revision expire my ISO/IEC 27001 certificate?

No. ISO/IEC 27007 is guidance, not a certifiable requirement standard. The certificate is issued against ISO/IEC 27001, and a new edition of the audit guidance does not end it. Certification bodies and accreditation bodies set their own rules for the audits they run. Read dates and stage.

When will the final edition be published?

ISO has not announced a date. The planning date used here is 12 September 2027, an estimate from stage 40.60 and about twelve months after the close of the DIS ballot. The next checkpoints are 40.99, 50.00, 50.20, 50.60 and 60.60. The free check keeps the date labelled.

What changes in the draft?

The public record shows a technical alignment, not a new audit standard. The document is aligned with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. Annex A is remapped to the 2022 clauses, 6.3 Planning of changes is added, and 10.1 and 10.2 swap. Read what changed.

Is this the ISO text?

No. This is a reference and a checker written in our own words, with a source pointer on every line. The licensed ISO/IEC 27007:2020 text is not reproduced, and the DIS body is not public. The site says which part of each answer comes from the held standard, which from the public DIS record, and which is an interpretation.

What do I get for USD 799?

The revision kit: a 71-row obligation register, the evidence list an auditor asks for, a dated plan and the 2020 to 2026 crosswalk, as PDF, CSV and XLSX. The labelled sample shows five rows. The change watch is USD 49 a month and emails you when the record, its guidance or its dates change.

The rules this is built from

Read from the real rules, not invented.

Every answer ISO 27007 Revision Checker gives points to the official rule behind it, so you can check any line yourself. The clause record is read from the held ISO/IEC 27007:2020 requirement set, the public DIS text and the held ISO/IEC 27001:2022 requirement set. The revision record is the ISO standard page, the public DIS contents and the ISO 19011:2026 record. Nothing is written from memory or from a search snippet.

43 clause records27 Annex A rows181 evidence items12 named sourcesCheck any line yourself

The rules this is built from · ISO/IEC 27007:2020 on the compliance library