ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.4.5.3, read with ISO/IEC 27001:2022, Clause 7.5.3
Control of documents
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
Documented information that the standard and the ISMS call for must be controlled so that people can get it, in a usable state, at the place and time they need it, and so that it is suitably protected, for example against loss of confidentiality, misuse or loss of integrity. As applicable, the organization addresses distribution, access, retrieval and use; storage and preservation including keeping it legible; control of changes such as version control; and retention and disposition. External documented information the organization needs for planning and operating the ISMS is identified as appropriate and controlled. A note explains that access can mean permission only to view, or also the right to edit.
How the 2020 guidance taught the audit
Auditors look at whether the documented information required by the ISMS and by ISO/IEC 27001 is controlled so that it is available and fit for use where and when needed and is suitably guarded against disclosure, misuse or corruption. They confirm that, as applicable, the organization handles distribution, access, retrieval and use; storage and preservation, including legibility, whether digital, other or handwritten; control of changes such as versioning; and retention and disposition; the structure and configuration of any document library is also evidence. As with 7.5.2, the check is made whenever documented information is shown during the audit, in enough cases to confirm conformity.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. Availability, protection, distribution, access, retrieval and retention still apply.
Evidence an auditor asks for
- Documented informationDocument control procedure or system configuration covering distribution, access, storage, versioning, retention and disposal
- Documented informationAccess rights and protection applied to sensitive documented information
- Documented informationVersion control evidence on sampled documents
- Documented informationRetention schedule and disposal records
- Documented informationStructure of the document library or repository
The questions an auditor will ask
Ask for a superseded document that is still in use, or for a record that cannot be retrieved.
Common gaps
- Superseded versions still accessible and in use
- Sensitive ISMS documents (risk register, SoA) readable by anyone
- Retention periods undefined or not applied
- Records alterable without trace
Prepare before the next audit
Test retrieval of a record from two years ago and the disposal of a superseded document.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.