ISO/IEC DIS 27007, Edition 4 (unpublished), Clause 3
Terms that changed
The DIS adopts the ISO 19011 term set and adds 50 defined terms for information security, risk and management systems. The practical change is that an audit finding has to use the same words as the ISMS: risk, risk owner, control, correction and corrective action.
The 2020 edition already used the ISO 19011:2018 terms and a set of information security terms. The DIS moves those references to the 19011 revision and to the 27000 family, including ISO/IEC 27002:2022, ISO/IEC 27005:2022 and ISO/IEC 27000. The defined terms are public in the ISO Online Browsing Platform, so a reader can check every one.
Three terms carry a practical audit consequence. Risk owner is defined as the person or entity with the accountability and authority to manage the risk, so a risk register with a name but no authority is a finding. Correction and corrective action are defined separately, so an audit that accepts a correction as a corrective action has not tested the cause. Documented information is defined as the information and its medium, so a record in a collaboration tool is still a record.
The DIS also carries the 19011 revision terms, including the definition of a remote auditing method. The 19011:2026 change summary records that virtual locations are treated as remote audits and that the observer definition now distinguishes an observer from a technical expert. Both distinctions appear in the audit conduct clauses.
What to keep
- The controlled audit procedure with the current reference editions
- A term list or glossary aligned to the DIS term set
- A sample of work papers using risk owner, correction and corrective action correctly
Common gaps
- The procedure still cites ISO 19011:2018
- Risk owners are named without authority
- A correction is accepted as a corrective action
What this means for your programme
Put the change in the programme record with a date, an owner and the source you checked. Do not rewrite the whole procedure on the strength of a draft. The kit's crosswalk and dated plan are built for this: one row per clause or annex row, with the current position and the draft position side by side.
This page is our reading of the public record. The DIS body is not public in full. Where a statement depends on the 19011:2026 change summary rather than on the DIS text, the page says so.
ISO/IEC DIS 27007 public text in the ISO Online Browsing Platform. ISO 19011:2026, Edition 4, standard page 88984. Held BS EN ISO 19011:2026 and the public change summary.
Retrieved 2026-10-19. The licensed texts are not reproduced.