ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.1.4, read with ISO/IEC 27001:2022, Clause 4.4
The ISMS itself
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
The organization must set up, put into operation, keep up and keep improving an ISMS, including the processes it needs and how those processes interact, in line with what this standard requires.
How the 2020 guidance taught the audit
Auditors confirm that the organization has set up the processes and controls that are needed, and sufficient, to form an effective ISMS made of interrelated or interacting elements as ISO/IEC 27001 requires: the management system processes, operational planning and control including outsourced processes, the risk assessment and treatment processes and their operation, and the processes that deliver the information security objectives. They also confirm that the audited organization keeps its own authority, accountability and autonomy in deciding how to meet the ISMS requirements, including how deeply and how far it integrates them with its business activities.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The clause still requires the processes and their interactions needed for the ISMS.
Evidence an auditor asks for
- Management systemProcess map or description of the ISMS processes and how they interact
- Management systemOperational planning and control records, including control of outsourced processes
- Management systemRisk assessment and risk treatment process descriptions and results
- Management systemPlans and records showing how the information security objectives are pursued
The questions an auditor will ask
Ask for the process map and then for the evidence that the interactions work, not only that they are drawn.
Common gaps
- ISMS exists as a document set with no evidence the processes operate
- Outsourced processes outside the process map
- Processes defined but their interactions not, so outputs of one never reach another
Prepare before the next audit
Keep a process map with owners, inputs, outputs and interfaces. Test one interface end to end.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.