ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.4.4, read with ISO/IEC 27001:2022, Clause 7.4
Communication
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
The organization must decide what internal and external communication the ISMS needs, covering what is communicated, when, to whom, and how.
How the 2020 guidance taught the audit
Auditors confirm that the organization's communication needs are determined, implemented and kept effective under the communication requirement of ISO/IEC 27001. Evidence can be answers recorded in meeting minutes, a formal communication plan with procedures and outcomes, or interviews with people holding specific responsibilities to confirm they know what to communicate, when, with whom, who may communicate and how it is done. Communications to look for cover why good security management and conformance matter, the policy, roles and authorities, ISMS performance, objectives, contributions to effectiveness, the implications of nonconformity and audit results. Auditors check that the organization has decided what qualities its communication needs, such as transparency, appropriateness, credibility, responsiveness, clarity and protection; communication may be oral or written, one-way or two-way, internal or external.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The clause still requires the what, when, with whom and how of internal and external communication.
Evidence an auditor asks for
- CommunicationCommunication plan or procedure stating what, when, with whom and by whom
- CommunicationMeeting minutes and messages showing the planned communications took place
- CommunicationInterview records with role holders on their communication duties
- CommunicationRecords of communications on policy, objectives, performance and audit results
The questions an auditor will ask
Ask for a communication that changed a decision or reached an external party, and for the record.
Common gaps
- Communication needs never determined, so effectiveness cannot be judged
- External communication (customers, regulators) unplanned
- Role holders unsure who is authorised to communicate on security matters
Prepare before the next audit
Define the communication matrix and test one external notification route.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.