The revision record

What the public record actually shows.

ISO/IEC DIS 27007 is at stage 40.60, close of voting on 23 September 2026. The DIS foreword states one main change: alignment with the 19011 revision and with ISO/IEC 27001:2022/Amd 1:2024. This record separates what the public text proves from what it does not. The DIS does not replace the 2020 edition until the final edition is published, and a certification body still applies ISO/IEC 27006-1 and ISO/IEC 17021-1 to a third-party audit.

Check your next audit Read the clause record

Stage record

DIS registered: 29 Apr 2026
Ballot opened: 30 Jun 2026
Close of voting: 23 Sep 2026
Edition: 4
Pages: 50
Replaces: 27007:2020

The ISO record is the source for every date on this page. Open it.

The six changes

What moved, and what did not.

The scope and the 5, 6 and 7 structure carry over from the 2020 edition. The DIS is a technical revision: it updates the references, remaps Annex A and carries the 19011:2026 changes in remote audit, programme risk and competence. It does not create a new certification scheme.

Terms that changed

The DIS adopts the ISO 19011 term set and adds 50 defined terms for information security, risk and management systems.

Read the change

Annex A

The Annex A remap

The biggest practical change is in Annex A.

Read the change

5.5.3 / 6.2.3

Remote and hybrid audits

The revision of ISO 19011 expands guidance on remote auditing methods and folds virtual locations into remote audit.

Read the change

5.3

Audit programme risk

The 19011 revision expands the risks an audit programme has to consider: loss of a competent auditor, on-site versus remote method, departures from the programme, lack of leadership support and the security of IT and data platforms.

Read the change

7.2.3 / 7.6

Auditor competence

The competence expectations move with the 19011 revision: data protection and information security knowledge are added, the responsible use of emerging technologies is added to audit conduct, the personal behaviour "fortitude" is removed, and competence monitoring has to use feedback from auditees and stakeholders..

Read the change

Stage

Dates and stage

The DIS is at stage 40.60, close of voting on 2026-09-23.

Read the change

Life cycle

What happens next.

The DIS ballot closed on 23 September 2026. The committee can refer the DIS back (40.92), decide on a new ballot (40.93) or approve it for registration as an FDIS (40.99). The FDIS has its own ballot (50.20) and a proof stage (50.60) before publication (60.60). No date is fixed until the stage changes.

40.99
DIS approved for registration as FDIS
50.00
FDIS registered
50.20
FDIS ballot
50.60
Close of FDIS voting
60.60
International Standard published

Only stages that have happened carry a date. The empty stages are listed because they are the next public checkpoints, not because a date is known.

What did not change

The things a reader often assumes changed.

Carried over

The scope and purpose of the guidance
The seven audit principles
The Clause 5, 6 and 7 structure
The 44 substantive clause records
The distinction between first, second and third party audits

Not claimed here

That the DIS is published
That a certificate expires
That the final text says what the DIS says
That the annex numbering is final
That a date has been announced

The DIS body is not public in full. The clause-level treatment on this site is our reading of the public structure and the 19011:2026 change, and every page says where the public record is silent.