The register is built from the sources below. The ISO page supplies the revision record and the dates. The held ISO/IEC 27004:2016 edition supplies the guidance. The ISO/IEC 27001:2022 clause 9.1 supplies the requirement. The practical reading is ours and is labelled as such.
| Source | Link | What it is used for |
|---|---|---|
| ISO/IEC DIS 27004, standard 85920 | https://www.iso.org/standard/85920.html | The official record: designation, title, edition, stage, stage date, page count, committee and ICS. |
| ISO/IEC 27004:2016, standard 64120 | https://www.iso.org/standard/64120.html | The published edition the DIS will replace. The clause and measure pages state its guidance in our own words from the complete copy held in the held source collection. |
| ISO/IEC 27001:2022, clause 9.1 | https://www.iso.org/standard/27001 | The requirement standard the guidance supports. Clause 9.1 is the requirement; 27004 is guidance. |
| ISO/IEC 15939, measurement process | https://www.iso.org/standard/71197.html | The measurement information model that Annex A applies to an ISMS. |
| ISO/IEC 27000, overview and vocabulary | https://www.iso.org/standard/73906.html | The defined terms used by the guidance. |
| The Art of Service reading | https://iso-27004-revision-checker.theartofservice.com/methodology/ | The practical lens, the practice line and the auditor probe are our reading of the held source. They are not the standard text and they create no requirement. |
What is not in the record
The DIS body is not public and is not held. This site does not quote it, summarise it as if it had read it, or infer its wording from the title. When the published text is available, the record is extended from it and the changelog records the change.
All links are checked before deployment. A source link that does not resolve is a build failure.