ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.4.1, read with ISO/IEC 27001:2022, Clause 7.1
Resources
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
The organization has to identify and supply the resources the ISMS needs to be set up, put into operation, maintained and continually improved.
How the 2020 guidance taught the audit
Auditors confirm that the organization foresees, determines and allocates the resources needed to establish and implement the ISMS, including its operation and controls, and to maintain and continually improve it. Resources may include people, specific skills and knowledge, infrastructure such as buildings and communication lines, technology, information and other assets tied to information processing, and finance.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The clause still requires the resources needed to establish, implement, maintain and improve the ISMS.
Evidence an auditor asks for
- ResourcesResource needs assessment for establishing, running and improving the ISMS
- ResourcesBudget and staffing allocations for information security
- ResourcesManagement review decisions on resources
The questions an auditor will ask
Ask for the resource decision behind a control that failed or a project that slipped.
Common gaps
- Resources determined for the initial implementation but not for maintenance and improvement
- Control operation dependent on staff or tools never budgeted
- No evidence resource needs were reassessed after scope or risk changes
Prepare before the next audit
Link the ISMS budget and people to the controls and objectives they support.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.