ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.4.7
Collecting and verifying information
Information becomes evidence only after it is verified.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.4.7 is followed (information collected by appropriate sampling and verified, only verified information accepted as evidence), and possible methods to collect information during an ISMS audit include reviewing documented information such as configuration data and computer logs, visiting the facilities that process information, watching the ISMS processes and their controls in operation, and using automated audit tools; Annex A gives guidance on auditing the ISMS processes and ISO/IEC TS 27008 on assessing controls; members of the ISMS audit team handle everything auditees give them properly, as agreed between the team, the auditee and the audit client.
Information becomes evidence only after it is verified. The team samples, cross-checks, observes and, where it can, uses automated tools, and it records how the information was verified. An interview on its own is a statement, not a finding.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The clause carries over; the DIS bibliography references ISO/IEC TS 27008 for control assessment and the ISO/IEC 27000 family for terms.
Evidence an auditor asks for
- Audit conductEvidence records showing logs, configurations, facility visits, observations and tool output
- Audit conductHandling agreement for information received from the auditee
The questions an auditor will ask
The assessor will ask how a sample was chosen, how the information was verified and what the team did when two sources disagreed.
Three tests to run before the next audit
- Ask for evidence records showing logs, configurations, facility visits, observations and tool output and trace it to the clause it is meant to satisfy.
- Ask for handling agreement for information received from the auditee and trace it to the clause it is meant to satisfy.
Common gaps
- Control effectiveness concluded from interviews with no log or configuration evidence
- Automated tool output taken as evidence without verification
Prepare before the next audit
Keep an evidence record per finding: source, date, method, what it showed and how it was verified. Mark the limits of the sample.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.