TS ISO/IEC 27007

TS ISO/IEC 27007 is a guidance document for how to manage an information security management system (ISMS) audit programme, how to conduct ISMS audits, and how to address auditor competence. Its focus is the audit of information security management, especially for internal and external audits and for those who administer the audit programme.

What an ISMS audit looks at

This standard complements the general auditing guidance in ISO 19011. In broader technical practice, an ISMS audit is not only about checking whether policies and procedures exist; it is about assessing whether the risk-based management approach is actually operating, whether controls are suitable and effective, and whether findings are supported by objective evidence. In environments where information security, cybersecurity and privacy protection overlap, this kind of audit helps align governance, operations and compliance expectations within one disciplined review process.

Audit programme management and auditor competence

• Audit programme management: planning, prioritising and coordinating audits.
• Audit execution: gathering evidence, evaluating it and reporting results.
• Auditor competence: guidance on the knowledge, skills and experience needed for ISMS auditors.
• Use context: applicable to those who need to understand or perform internal or external audits of an ISMS.

The document is about how to audit an ISMS, not how to establish the ISMS itself. That distinction matters: the ISMS standard defines the management framework for security, while TS ISO/IEC 27007 supports the methodical review of that framework through auditing.