The rules this is built from
ISO/IEC 27007 is the method. It is not the obligation. An ISMS audit is run against criteria, and those criteria include the law and the control sets that apply to the buyer in each market. This page names the held frameworks the record reads for the four markets, in order: United States, European Union, United Kingdom and Australia.
The 27007 pages tell you how to run the audit. The frameworks below tell you what an audit may test in each market. They do not replace ISO/IEC 27001, and they do not all apply to every organisation.
The audit criteria an ISMS may add in the United States. The 27007 guidance is the method; these are obligations or control sets the audit can be run against.
How it maps: the 27007 guidance is the audit method; the frameworks below are criteria an audit may test. A framework applies only where its own scope reaches the organisation, so a financial-sector rule is not asserted for a non-financial buyer.
European obligations that commonly become audit criteria for an ISMS, especially for essential, financial and digital service providers.
How it maps: the 27007 guidance is the audit method; the frameworks below are criteria an audit may test. A framework applies only where its own scope reaches the organisation, so a financial-sector rule is not asserted for a non-financial buyer.
UK criteria an ISMS audit may test alongside ISO/IEC 27001. The NCSC framework is used in regulated sectors and critical national infrastructure.
How it maps: the 27007 guidance is the audit method; the frameworks below are criteria an audit may test. A framework applies only where its own scope reaches the organisation, so a financial-sector rule is not asserted for a non-financial buyer.
Australian criteria an ISMS audit may test: privacy obligations, the Essential Eight maturity model and the critical infrastructure rules.
How it maps: the 27007 guidance is the audit method; the frameworks below are criteria an audit may test. A framework applies only where its own scope reaches the organisation, so a financial-sector rule is not asserted for a non-financial buyer.
It does not claim that every framework applies to every reader. It does not quote a regime we do not hold. Where a market's regime is not held, the page names it and says so. The frameworks are chosen by a scan of the held library against the buyer's activity and data, then read for relevance; they are not a fixed list.
Links go to the compliance library. Each framework page states its edition, its source class and its coverage.