What is the difference between ISO 27007 and ISO 19011?

ISO 19011 gives the general method for auditing any management system. ISO 27007 takes that method and adds the ISMS-specific guidance: information security criteria, the Statement of Applicability, ISMS auditor competence and an annex of audit guidance for the ISO/IEC 27001 clauses.

The general method

ISO 19011 covers the principles of auditing, managing an audit programme, conducting an audit and evaluating auditor competence. It is written for any management system, so it cannot tell an auditor what evidence an ISMS needs.

The ISMS addition

ISO 27007 follows the 19011 structure and adds the ISMS layer: the audit criteria that come from the information security policy, risk process and Statement of Applicability; the ISMS auditor knowledge and skills; and Annex A, which gives audit guidance for each ISO/IEC 27001 clause.

The reference moves

The 2020 edition aligned with ISO 19011:2018. The DIS aligns with the 19011 revision, published as ISO 19011:2026. The practical change is the expansion of remote audit guidance and the sharper programme risk list, not a new audit method.

Which one to read first

Read 19011 for the method and 27007 for the ISMS evidence. If you only read 27007, you will miss the programme and competence discipline that 19011 supplies. If you only read 19011, you will miss the annex rows that make the ISMS audit specific.