ISO/IEC DIS 27007, Edition 4 (unpublished), Clauses 1 to 3
Scope, references and terms
The first three clauses tell the reader where the guidance sits.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
Clause 1 states the document's purpose: it helps a reader run an ISMS audit programme, carry out audits and judge the competence of ISMS auditors, on top of what ISO 19011 already says. It applies to anyone who needs to understand or conduct an internal or external ISMS audit, or who manages an ISMS audit programme. Clause 2 names the normative references of the 2020 edition: ISO 19011:2018 and ISO/IEC 27001:2013. The DIS moves them to the 19011 revision (published as ISO 19011:2026) and ISO/IEC 27001:2022/Amd 1:2024. Clause 3 adopts the terms and definitions of ISO 19011 and adds a set of information security, risk and management system terms, from authenticity and availability to risk owner and top management. The DIS carries 50 defined terms.
The first three clauses tell the reader where the guidance sits. It is a type B management system guidance standard, built on top of ISO 19011 and tied to ISO/IEC 27001. It is not a certifiable requirement standard, and it does not create a new obligation on an organisation. The terms matter because an audit finding that uses "risk" or "control" in a different sense from the ISMS is a finding that cannot be tested.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The scope is unchanged. The normative references move to the revision of ISO 19011 (published as ISO 19011:2026 on 2026-05-27) and to ISO/IEC 27001:2022/Amd 1:2024. The DIS carries 50 defined terms, drawing on ISO/IEC 27002:2022, ISO/IEC 27005:2022 and the ISO/IEC 27000 family.
Evidence an auditor asks for
- Not stated in the textClauses 1 to 3 do not ask for a record. There is no evidence item to produce for them.
The questions an auditor will ask
There is no evidence to produce for clauses 1 to 3. The assessor uses them to test whether the audit programme is inside the scope the document describes, and whether the audit team uses the defined terms consistently.
Three tests to run before the next audit
- Ask for clauses 1 to 3 do not ask for a record. there is no evidence item to produce for them and trace it to the clause it is meant to satisfy.
Common gaps
- The audit procedure cites ISO/IEC 27007 as a certifiable standard
- The audit team uses risk and control in senses that differ from the ISMS
- The procedure still cites ISO 19011:2018 as the normative reference
Prepare before the next audit
Check the audit procedure and the work papers for the reference edition and for the term set. Replace ISO 19011:2018 with ISO 19011:2026 in the controlled documents, and replace ISO/IEC 27001:2013 with 2022 in the criteria.
Cross-references
ISO/IEC DIS 27007 public text in the ISO Online Browsing Platform. https://www.iso.org/obp/ui#iso:std:iso-iec:27007:dis:ed-4:v1:en
Retrieved 2026-10-19. Foreword, introduction, scope, normative references, terms and definitions, and bibliography are public. Clauses 4 to 7 and Annex A are not public in full.