Answer
What changed in ISO 27007:2026?
The DIS foreword states one main change: alignment with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. Our reading of that alignment is that Annex A is remapped to 2022, 6.3 is added and 10.1 and 10.2 swap. The DIS body is not public, so those are inferences.
The one change the foreword states
The DIS foreword says the document is aligned with the 19011 revision and with ISO/IEC 27001:2022/Amd 1:2024. That is the only main change the public text states. Everything else on this page is our reading of the public record and the 19011:2026 change, and is labelled as such.
Annex A
The 2020 annex rows were written against the 2013 edition. The DIS moves them to 2022. The 2022 edition adds 6.3 Planning of changes, changes 8.1 to require criteria and control of changes, splits 9.2 into a general clause and a programme clause, and swaps 10.1 and 10.2. The control annex moves from 114 controls in 14 sections to 93 controls in four themes.
Remote audit
ISO 19011:2026 expands guidance on remote auditing methods and folds virtual locations into remote audit. The DIS is aligned to that text. The audit file should say what the method could reach and what the method could not reach, including what was verified remotely and what was left to an on-site visit.
Competence
The 19011:2026 revision adds data protection and information security knowledge, adds the responsible use of emerging technologies in audit conduct, removes fortitude from the personal behaviour list, and asks competence monitoring to use feedback from auditees and stakeholders.
What is not public
The DIS body, clauses 4 to 7 and Annex A, is not public in full. This site does not quote it. The clause-level treatment is a reading of the public structure and the 19011 change.
Read next
Not legal advice; does not certify. The record date is 2026-10-19. Check the sources on the revision record.