ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.2.2, read with ISO/IEC 27001:2022, Clause 5.2
Policy
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
Top management must set an information security policy that suits the organization's purpose; states the security objectives (6.2) or gives a framework for setting them; commits to meeting applicable information security requirements; and commits to continually improving the ISMS. The policy must exist as documented information, be communicated internally, and be made available, where appropriate, to interested parties.
How the 2020 guidance taught the audit
Auditors confirm that the information security policy states top-level organizational commitments in line with ISO/IEC 27001, taking the organization's purpose into account; that it is used to derive the information security objectives or states them itself; that it is created and controlled as documented information under 7.5; that it is communicated internally under 7.4; and that it is made available to interested parties as appropriate. Because the policy commits to meeting applicable requirements, including legislation, an incident caused by a system weakness does not by itself make the ISMS unfit, provided the weakness is found and corrected promptly.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The policy still has to be appropriate to the purpose, include objectives and commitment, and be available and communicated.
Evidence an auditor asks for
- PolicyApproved information security policy with version and approval record
- PolicyObjectives derived from or stated in the policy
- PolicyCommunication records showing staff were informed of the policy
- PolicyEvidence of how the policy is made available to interested parties
The questions an auditor will ask
Ask an employee to find the policy and a manager to explain how it constrains a real decision.
Common gaps
- Policy carries no commitment to meet applicable requirements or to improve
- Objectives cannot be traced to the policy
- Policy not communicated beyond the security team
- Policy uncontrolled, with several versions in circulation
Prepare before the next audit
Check the policy against the current risk appetite, the legal register and the objectives. Remove commitments the organisation does not resource.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.