Do I need to update my internal audit programme

Do I need to update my internal audit programme for ISO 27007:2026?

Not before the final edition is published, unless your criteria or annex rows still use the 2013 edition of ISO/IEC 27001. Then review them now. The DIS is a draft and does not replace the 2020 guidance. Put the programme review on the calendar before the planning date.

The current position

The published guidance is ISO/IEC 27007:2020. A DIS is a draft and cannot be cited as the current guidance. An internal audit run today is against the 2020 edition, whatever the DIS says.

The 2013 dependency

The 2020 Annex A rows follow ISO/IEC 27001:2013. If your procedure, work papers or Statement of Applicability still cite 2013 clauses or the 114-control annex, you have a live gap independent of the revision. Review those first.

The programme review

Put a review on the calendar before the planning date. The review should cover the criteria edition, the annex crosswalk, the 6.3 row, the 10.1 and 10.2 swap, the competence matrix and the remote method record. Record the date, the owner and the source checked.

What to do if the audit is after the planning date

Build the update now. Use the crosswalk to mark the changed rows, correct the clause references, and brief the team. Keep the plan conditional: the final text may differ from the DIS, and the record is rebuilt when it is published.