ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.2.3, read with ISO/IEC 27001:2022, Clause 5.3
Roles and authorities
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
Top management must make sure that every role that matters for information security has its responsibilities and authorities assigned and made known internally, and must specifically assign responsibility and authority for making sure the ISMS conforms to this standard and for reporting ISMS performance to top management. A note allows responsibilities for internal performance reporting to be assigned as well.
How the 2020 guidance taught the audit
Through document review and interviews, auditors confirm that responsibilities and authorities for meeting the ISMS requirements are assigned to the relevant functions; that top management remains accountable for them and delegates authority to the people carrying out the roles; that roles are communicated under 7.4; that conformity with ISO/IEC 27001 is checked through internal audit under 9.2; and that performance reporting happens through management review under 9.3. They check that the people holding these roles have enough access to top management to report on ISMS status and performance. The conformance role may sit with one person, be shared, or be given to a team.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. Roles and authorities still have to be assigned and communicated.
Evidence an auditor asks for
- RolesOrganization chart and role descriptions for ISMS roles
- RolesJob descriptions of people whose work affects information security performance
- RolesAppointment or delegation records naming who ensures conformance and who reports on performance
- RolesInternal audit programme and results, and management review records of performance reporting
The questions an auditor will ask
Ask for the role that owns the ISMS, the role that owns a risk and the role that can stop a change. Check they are different where they need to be.
Common gaps
- Roles named on paper but the holders unaware of them
- No one assigned to report ISMS performance to top management
- Role holders with no practical access to top management
- Responsibilities for outsourced or shared services unassigned
Prepare before the next audit
Publish the ISMS role map and test one escalation path.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.