ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.4.3, read with ISO/IEC 27001:2022, Clause 7.3
Awareness
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
People working under the organization's control need to know about the information security policy, the part they play in making the ISMS effective (including what better security performance brings), and what follows from not conforming with ISMS requirements.
How the 2020 guidance taught the audit
Auditors confirm, by interviewing a suitable sample of people working under the organization's control, that they know the information security policy, how their own work helps the ISMS succeed (including what better security performance brings), and what follows if they do not conform. Knowing the policy does not mean reciting it: people should know its main commitments and their part in delivering them. Evidence of awareness may come from initiatives not aimed at information security alone and can be closely tied to top management's communication activities.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The clause still requires awareness of the policy, the contribution to the ISMS and the implications of not conforming.
Evidence an auditor asks for
- AwarenessAwareness programme and materials, where they exist
- AwarenessInterview sample results from staff and contractors
- AwarenessRecords linking awareness content to the policy, objectives and nonconformity lessons
- AwarenessTop management communications on information security
The questions an auditor will ask
Ask a sample of staff what the policy means for their work and what they would do with a suspected incident.
Common gaps
- Staff can recite the policy title but not what it commits them to
- Awareness limited to an induction module never repeated
- Contractors under the organization's control outside the awareness programme
- Interview sample too small or limited to the security team
Prepare before the next audit
Test awareness by role, not by attendance. Record the result and the action.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.