{
 "current_standard": "ISO/IEC 27007:2020, Edition 3",
 "current_note": "The 2020 edition is the published guidance. The DIS does not replace it until the final edition is published. A certificate is issued against ISO/IEC 27001, not against 27007.",
 "planning_date": "2027-09-12",
 "planning_basis": "An estimate from stage 40.60, about twelve months after the close of the DIS ballot. Not an ISO date.",
 "publication_window": "2027",
 "stage": "40.60 Close of voting",
 "stage_date": "2026-09-23",
 "ballot_open": "2026-06-30",
 "next_checkpoints": [
  {
   "code": "40.99",
   "label": "DIS approved for registration as FDIS",
   "date": null
  },
  {
   "code": "50.00",
   "label": "FDIS registered",
   "date": null
  },
  {
   "code": "50.20",
   "label": "FDIS ballot",
   "date": null
  },
  {
   "code": "50.60",
   "label": "Close of FDIS voting",
   "date": null
  },
  {
   "code": "60.60",
   "label": "International Standard published",
   "date": null
  }
 ],
 "questions": [
  {
   "id": "audit_type",
   "label": "What kind of ISMS audit do you run?",
   "type": "select",
   "options": [
    [
     "first",
     "First party, internal audit"
    ],
    [
     "second",
     "Second party, supplier or partner audit"
    ],
    [
     "third",
     "Third party, certification audit"
    ],
    [
     "mixed",
     "More than one of these"
    ]
   ],
   "required": true,
   "hint": "The guidance concentrates on first and second party audits. Some of it is not appropriate for a certification audit."
  },
  {
   "id": "criteria",
   "label": "Which ISO/IEC 27001 edition is in your audit criteria?",
   "type": "select",
   "options": [
    [
     "2013",
     "ISO/IEC 27001:2013"
    ],
    [
     "2022",
     "ISO/IEC 27001:2022 with Amendment 1:2024"
    ],
    [
     "both",
     "Both, during a transition"
    ],
    [
     "unsure",
     "Not sure"
    ]
   ],
   "required": true,
   "hint": "The 2020 Annex A rows were written against the 2013 edition. The DIS aligns them to 2022."
  },
  {
   "id": "programme",
   "label": "How is the audit programme recorded?",
   "type": "select",
   "options": [
    [
     "documented",
     "A controlled programme with objectives, risks and a review date"
    ],
    [
     "informal",
     "A calendar or a spreadsheet, no objectives or review"
    ],
    [
     "none",
     "No programme yet"
    ]
   ],
   "required": true,
   "hint": "Clause 5 is about managing a programme, not only running audits."
  },
  {
   "id": "remote",
   "label": "Do you use remote or hybrid audit methods?",
   "type": "select",
   "options": [
    [
     "yes",
     "Yes, regularly"
    ],
    [
     "planned",
     "Planned for the next cycle"
    ],
    [
     "no",
     "No, on site only"
    ]
   ],
   "required": true,
   "hint": "The 19011 revision expands remote audit guidance, and the DIS aligns to it."
  },
  {
   "id": "next_audit",
   "label": "When is your next ISMS audit?",
   "type": "month",
   "required": true,
   "hint": "A month is enough. The check uses it to place the audit before or after the planning date."
  },
  {
   "id": "target",
   "label": "When do you want the programme reviewed?",
   "type": "month",
   "required": true,
   "hint": "The planning date is 12 September 2027. You can choose earlier."
  }
 ],
 "verdicts": [
  {
   "id": "current",
   "label": "Current guidance applies, no revision work before this audit",
   "when": "next_audit before 2027-09 and criteria is 2022 and programme is documented",
   "text": "Your next audit falls before the planning date and your criteria and programme are already on the 2022 edition. Keep the 2020 guidance for this audit. Recheck the stage after the next ISO checkpoint and put the programme review on the calendar.",
   "actions": [
    "Record the stage and date you checked, with the source URL.",
    "Keep the 2020 guidance as the reference for this audit.",
    "Put the programme review on the calendar before the planning date."
   ]
  },
  {
   "id": "dependencies",
   "label": "Current guidance applies, but you have 2013 dependencies to review",
   "when": "criteria is 2013, both or unsure",
   "text": "The audit you run today is against the 2020 guidance, but some of your criteria or annex rows are tied to the 2013 edition. The DIS moves the annex to ISO/IEC 27001:2022. Review the 2013 references before the next audit cycle, not after publication.",
   "actions": [
    "List every 2013 clause and annex reference in the procedure and work papers.",
    "Refresh the Statement of Applicability against the 2022 control set.",
    "Map the 2020 annex rows to the 2022 clauses and mark the changed rows."
   ]
  },
  {
   "id": "plan",
   "label": "Plan the update before publication",
   "when": "next_audit on or after 2027-09, or target on or before the planning date",
   "text": "Your next audit sits at or after the planning date. Your chosen review date is recorded with the plan. Build the update now: the crosswalk, the 2022 criteria, the 6.3 row and the 10.1 and 10.2 swap. The DIS is not published, so the plan is dated and conditional, not a claim about the final text.",
   "actions": [
    "Set a programme review date before the planning date.",
    "Rebuild the criteria and the annex crosswalk against 27001:2022.",
    "Add the 6.3 Planning of changes row and correct the 10.1 and 10.2 references.",
    "Brief the audit team on remote methods and the 2022 evidence."
   ]
  },
  {
   "id": "incomplete",
   "label": "Scope incomplete",
   "when": "a required answer is missing",
   "text": "One or more answers are missing, so the check cannot place your programme. Answer every question. It does not guess.",
   "actions": [
    "Answer the missing question.",
    "Run the check again."
   ]
  }
 ],
 "notes": {
  "third": "This is a certification audit. ISO/IEC 27006-1:2024 and ISO/IEC 17021-1 apply to the certification body, and some of the 27007 guidance is not appropriate for a certification audit. Use the 27007 pages for the audit programme and competence questions, and the certification body rules for the findings process.",
  "second": "This is a second-party audit. The criteria include your contract and the supplier requirements, not only the 27001 clauses. Put them into the audit criteria and the report.",
  "first": "This is an internal audit. ISO/IEC 27001:2022 Clause 9.2 still governs the programme; the 27007 guidance tells you how to run it.",
  "mixed": "You run more than one audit type. Keep separate criteria and separate findings rules for the certification work; the 27007 guidance is written mainly for first and second party audits.",
  "remote": "You use remote or hybrid methods. Record what the method could reach and what it could not, and revisit feasibility if an incident or a travel restriction affects the audit.",
  "informal": "Your programme is not yet a managed programme. Clause 5 asks for objectives, risks, resources, records and a review. Start with one page and one review date.",
  "none": "There is no programme yet. Build the smallest one that satisfies Clause 5: objectives, extent, one risk review, one audit, one records set and a review date."
 },
 "sources": [
  {
   "label": "ISO/IEC DIS 27007, stage and life cycle",
   "url": "https://www.iso.org/standard/92416.html"
  },
  {
   "label": "ISO/IEC 27007:2020, published edition",
   "url": "https://www.iso.org/standard/77802.html"
  },
  {
   "label": "ISO 19011:2026",
   "url": "https://www.iso.org/standard/88984.html"
  },
  {
   "label": "ISO/IEC 27001:2022",
   "url": "https://www.iso.org/standard/27001"
  }
 ]
}