ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.4.5
Audit information and access
The team needs access to the information the audit requires, and the auditee needs confidence that the information will be handled properly.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.4.5 is followed (methods follow where, when and how the information can be accessed, physical or virtual, and may need to change during the audit), and where classification or sensitivity keeps some audit evidence from the team during the audit, the lead auditor should judge how far this lowers confidence in what the audit found and concluded, and say so in the report, without revealing anything sensitive about the evidence that was withheld.
The team needs access to the information the audit requires, and the auditee needs confidence that the information will be handled properly. Access includes systems, logs, configurations and people, and it includes the authority to see them.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision expands the handling of confidential information to include storage, transfer and release.
Evidence an auditor asks for
- Audit conductAudit report statements on evidence withheld and the effect on confidence
- Audit conductAccess log of what the team could and could not see
The questions an auditor will ask
The assessor will ask for an access request that was refused and how it was resolved, and for the handling rules for confidential evidence.
Three tests to run before the next audit
- Ask for audit report statements on evidence withheld and the effect on confidence and trace it to the clause it is meant to satisfy.
- Ask for access log of what the team could and could not see and trace it to the clause it is meant to satisfy.
Common gaps
- Conclusions stated with full confidence although key evidence was withheld
- Reports that describe the withheld evidence in enough detail to expose it
Prepare before the next audit
List the access needed per audit area, agree it before the audit, and record the handling, storage, transfer and release rules.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.