TS EN ISO 27007

TS EN ISO 27007 is a guideline standard for planning and managing an information security management system (ISMS) audit programme, carrying out audits, and addressing auditor competence. It builds on the general auditing guidance in ISO 19011 and expands it for the specific context of ISMS auditing.

How the ISMS audit programme is organised

The standard is aimed less at isolated audit events and more at the overall audit programme. In general technical terms, an ISMS audit assesses whether an organisation’s information security controls, risk-based practices, and management-system processes are working as intended. An audit programme brings together scheduling, prioritisation, resourcing, and follow-up so that audit activity remains systematic and risk-aware.

Auditor competence and audit practice

• Provides guidance for those who need to understand or conduct internal or external ISMS audits.
• Supports the people responsible for managing an ISMS audit programme.
• Adapts the general audit principles of ISO 19011 to the information security management context.
• Connects auditor competence with the professional understanding needed to audit an information security management system.

In the broader field of information security, cybersecurity, and privacy protection, guidance standards like this help keep audit practice consistent and meaningful. TS EN ISO 27007 focuses on clarifying the approach and terminology used when examining an organisation’s security management system, rather than prescribing new security controls themselves.