ISO/IEC DIS 27004
Edition 3, 66 pages. Committee ISO/IEC JTC 1/SC 27. ICS 35.030.
The official page gives a stage, a stage date, an edition, a page count and a committee. It gives no publication date. This page keeps the recorded facts separate from the estimate, because the difference decides what you can tell a customer or an auditor.
DESIGNATION
CURRENT STAGE
40.60, close of voting
Recorded on 16 September 2026. The enquiry ballot has closed. The next recorded step depends on the result.
PLANNING DATE
14 September 2027
An estimate, not a recorded ISO date. It is calculated from the current stage and the normal path to publication.
The stage path
| Stage | What it means | Date | Source |
|---|---|---|---|
| 10.99 | New project approved | 28 October 2024 | ISO stage record |
| 20.20 | Working draft study initiated | 28 October 2024 | ISO stage record |
| 20.60 | Close of comment period | 5 February 2025 | ISO stage record |
| 30.00 | Committee draft registered | 27 May 2025 | ISO stage record |
| 30.20 | CD consultation initiated | 28 May 2025 | ISO stage record |
| 30.60 | Close of comment period | 29 August 2025 | ISO stage record |
| 30.99 | CD approved for registration as DIS | 16 April 2026 | ISO stage record |
| 40.00 | DIS registered | 22 April 2026 | ISO stage record |
| 40.20 | DIS ballot initiated, 12 weeks | 23 June 2026 | ISO stage record |
| 40.60 | Close of voting | 16 September 2026 | ISO stage record |
| 40.92 | Full report circulated: referred back to TC or SC | Not dated | Stage code, not dated on the record |
| 40.93 | Full report circulated: decision for a new DIS ballot | Not dated | Stage code, not dated on the record |
| 40.99 | Full report circulated: DIS approved for registration as FDIS | Not dated | Stage code, not dated on the record |
| 50.00 | Final text received or FDIS registered for formal approval | Not dated | Stage code, not dated on the record |
| 60.00 | International Standard under publication | Not dated | Stage code, not dated on the record |
| 60.60 | International Standard published | Not dated | Stage code, not dated on the record |
What the page does not say
- No publication date is recorded. The planning date is not a date on the ISO page.
- The abstract on the ISO page still describes the 2016 edition, which served ISO/IEC 27001:2013, clause 9.1. The title and edition are current; the abstract has not been updated.
- No date is recorded for stage 40.92, 40.93 or 40.99.
- No FDIS date and no transition arrangement are recorded.
What this means for a certificate
Nothing on this page changes a certificate. ISO/IEC 27001:2022 is the certifiable requirement. ISO/IEC 27004 is guidance on how to evaluate performance and effectiveness under clause 9.1. A guidance draft does not create a transition audit, does not extend a transition period and cannot be certified against. If a customer asks whether you are "27004 compliant", the honest answer is that the document is guidance, the published edition is 2016, and the revision is a draft.