ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 6.5.2
Distributing the audit report
Distribution is a controlled act.
Three layers on this page. 1. The 2020 guidance as published, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current external references a 2026 audit may use: ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. 3. The DIS, limited to what the public record proves; inference is labelled.
The 2020 guidance as published
This is the 2020 layer. It cites ISO 19011:2018 and ISO/IEC 27001:2013, as the 2020 edition did. It is not a statement of the DIS.
ISO 19011:2018, 6.5.2 is followed (issued within the agreed period, dated, reviewed and accepted, distributed to the parties the programme defines with appropriate confidentiality measures), with a note that where the report is sent electronically, suitable encryption is one way to satisfy its confidentiality requirements; the first paragraph of the former 6.5.2.2 was removed in this edition.
Distribution is a controlled act. The report goes to the people named in the audit agreement, in the agreed form, with the agreed confidentiality, and the distribution is recorded. A report sent to the wrong inbox is a confidentiality incident.
The DIS layer: what the public record shows
The DIS foreword aligns the revision with ISO 19011:2026 and ISO/IEC 27001:2022/Amd 1:2024. The DIS body is not public in full; this is the alignment, not a quotation.
The 19011:2026 revision expands the handling of confidential information to include storage, transfer and release.
Evidence an auditor asks for
- Audit reportingDistribution records with the protection applied to electronic copies
The questions an auditor will ask
The auditor will ask who received the report, under what agreement, and where the distribution is recorded.
Three tests to run before the next audit
- Ask for distribution records with the protection applied to electronic copies and trace it to the clause it is meant to satisfy.
Common gaps
- ISMS audit reports naming vulnerabilities sent as plain email attachments
- Distribution wider than the programme defines
Prepare before the next audit
Name the recipients in the audit agreement, record the date and method of distribution, and keep the report with the audit file.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.