ISO/IEC DIS 27007 · stage 40.60, close of voting Ballot closed 23 September 2026 Planning date 12 September 2027, an estimate Official text
27007ISO 27007 Revision CheckerISMS audit guidance, clause by clause

The clause record

Every clause, the evidence and the draft treatment.

43 substantive clause records, plus the scope and terms page, each stating what applies today under the 2020 edition, what the DIS moves, and what an auditor will ask for. The general subclauses are carried on the page that follows them, because they contain no separate requirement.

How to use it

Start with Clause 5.5.2 if you are reviewing the criteria, Clause 5.5.7 if you are reviewing the records, or Clause 7.2.3 if you are reviewing competence. Each page has the same shape, so you can compare clauses.

Run the free edition check

43 substantive clause records
ClauseRecordGroupDraft treatmentEvidence
1-3Scope, references and termsScope, references and termsre-referenced1
4Principles of auditingPrinciples of auditingaligned2
5.1Establishing the audit programmeManaging an audit programmealigned2
5.2Audit programme objectivesManaging an audit programmere-referenced2
5.3Audit programme risksManaging an audit programmealigned2
5.4.1Roles of the programme managerManaging an audit programmealigned3
5.4.2Competence of the programme managerManaging an audit programmere-referenced2
5.4.3Extent of the audit programmeManaging an audit programmesilent2
5.4.4Audit programme resourcesManaging an audit programmealigned2
5.5.2Objectives, scope and criteriaManaging an audit programmere-referenced2
5.5.3Selecting audit methodsManaging an audit programmealigned2
5.5.4Selecting audit team membersManaging an audit programmealigned2
5.5.5Responsibility to the team leaderManaging an audit programmesilent1
5.5.6Managing programme resultsManaging an audit programmesilent1
5.5.7Programme recordsManaging an audit programmealigned1
5.6Monitoring the audit programmeManaging an audit programmesilent2
5.7Reviewing the audit programmeManaging an audit programmealigned1
6.2.2Contact with the auditeeConducting an auditsilent2
6.2.3Feasibility of the auditConducting an auditaligned2
6.3.1Reviewing documented informationConducting an auditsilent2
6.3.2Audit planningConducting an auditaligned2
6.3.3Assigning work to the teamConducting an auditre-referenced1
6.3.4Preparing audit documentsConducting an auditsilent2
6.4.2Guides, observers and expertsConducting an auditaligned1
6.4.3Opening meetingConducting an auditaligned1
6.4.4Communicating during the auditConducting an auditsilent1
6.4.5Audit information and accessConducting an auditaligned2
6.4.6Reviewing documents during the auditConducting an auditsilent2
6.4.7Collecting and verifying informationConducting an auditre-referenced2
6.4.8Generating audit findingsConducting an auditaligned1
6.4.9Audit conclusionsConducting an auditsilent1
6.4.10Closing meetingConducting an auditaligned1
6.5.1Preparing the audit reportConducting an auditaligned1
6.5.2Distributing the audit reportConducting an auditaligned1
6.6Completing the auditConducting an auditsilent2
6.7Audit follow-upConducting an auditre-referenced1
7.2.2Personal behaviourCompetence and evaluation of auditorsaligned2
7.2.3Knowledge and skillsCompetence and evaluation of auditorsaligned3
7.2.4Achieving auditor competenceCompetence and evaluation of auditorsre-referenced3
7.2.5Team leader competenceCompetence and evaluation of auditorssilent1
7.3Auditor evaluation criteriaCompetence and evaluation of auditorssilent1
7.4Auditor evaluation methodCompetence and evaluation of auditorsaligned1
7.5Conducting auditor evaluationCompetence and evaluation of auditorssilent1
7.6Maintaining auditor competenceCompetence and evaluation of auditorsaligned2

The general subclauses 5.5.1, 6.1, 6.2.1, 6.4.1, 7.1 and 7.2.1 are listed in the DIS contents and carry no separate requirement. Their substance is on the page that follows: 5.5.2, 6.2.2, 6.2.2, 6.4.2, 7.2.2 and 7.2.2. Clause 1, 2 and 3 are on the scope, references and terms page.