ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.2.2
Contact with the auditee
Before an audit can start, the team establishes contact with the auditee, confirms who has authority to agree the audit, and settles the practical and confidentiality arrangements.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.2.2 is followed (confirming channels and authority, providing objectives, scope, criteria, methods and team composition, requesting planning information including the auditee's risks and opportunities, determining applicable requirements, agreeing confidentiality and information security, arranging the audit and any observers and guides), and where needed, steps should be taken to confirm the auditors hold the security clearance required to access the documented information or other information the audit requires, including confidential or sensitive information.
Before an audit can start, the team establishes contact with the auditee, confirms who has authority to agree the audit, and settles the practical and confidentiality arrangements. This is where access, language, safety and information handling are agreed, not discovered on the first morning.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The public DIS record does not show a change to this clause. The clause number and title are unchanged.
Evidence an auditor asks for
- Audit initiationInitial contact record with the confidentiality and access arrangements agreed
- Audit initiationSecurity clearances obtained for auditors before fieldwork
The questions an auditor will ask
The auditor will ask who agreed the audit on the auditee side and where the confidentiality and access arrangements are recorded.
Three tests to run before the next audit
- Ask for initial contact record with the confidentiality and access arrangements agreed and trace it to the clause it is meant to satisfy.
- Ask for security clearances obtained for auditors before fieldwork and trace it to the clause it is meant to satisfy.
Common gaps
- Auditors arriving without clearance to see the classified evidence the plan relies on
- Access arrangements negotiated on the day
Prepare before the next audit
Send a short audit initiation note that names the authority, the scope, the criteria, the team, the access needs and the confidentiality terms.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.