ISO/IEC DIS 27003
Edition 3, 50 pages. Committee ISO/IEC JTC 1/SC 27. ICS 35.030 and 03.100.70.
The official page gives a stage, a stage date, an edition, a page count and a committee. It gives no publication date. This page keeps the recorded facts separate from the projection, because the difference decides what you can tell a customer or an auditor.
DESIGNATION
CURRENT STAGE
40.00, DIS registered
Recorded on 2 October 2026. The DIS is in the enquiry phase with ISO members. A 12 week ballot is the next step.
PLANNING DATE
13 September 2027
A projection, not a recorded ISO date. It is calculated from the current stage and the normal path to publication.
The stage path
| Stage | What it means | Date | Source |
|---|---|---|---|
| 10.99 | New project approved | 3 May 2024 | Recorded on the ISO page |
| 20.00 | New project registered in TC/SC work programme | 3 May 2024 | Recorded on the ISO page |
| 30.00 | Committee draft (CD) registered | 26 March 2025 | Recorded on the ISO page |
| 30.20 | CD consultation initiated | 27 March 2025 | Recorded on the ISO page |
| 30.60 | Close of comment period | 23 May 2025 | Recorded on the ISO page |
| 30.92 | CD referred back to Working Group | 25 November 2025 | Recorded on the ISO page |
| 30.00 | Committee draft (CD) registered, second round | 25 November 2025 | Recorded on the ISO page |
| 30.20 | CD consultation initiated, second round | 27 November 2025 | Recorded on the ISO page |
| 30.60 | Close of comment period, second round | 23 January 2026 | Recorded on the ISO page |
| 30.92 | CD referred back to Working Group | 10 April 2026 | Recorded on the ISO page |
| 30.00 | Committee draft (CD) registered, third round | 10 April 2026 | Recorded on the ISO page |
| 30.20 | CD consultation initiated, third round | 11 April 2026 | Recorded on the ISO page |
| 30.60 | Close of comment period, third round | 7 June 2026 | Recorded on the ISO page |
| 30.99 | CD approved for registration as DIS | 29 September 2026 | Recorded on the ISO page |
| 40.00 | DIS registered | 2 October 2026 | Recorded on the ISO page; current stage |
| 40.20 | DIS ballot initiated: 12 weeks | Not dated | Not dated on the ISO page at retrieval |
| 40.60 | Close of voting | Not dated | Not dated on the ISO page at retrieval |
| 50.00 | Final text received or FDIS registered for formal approval | Not dated | Not recorded |
| 50.20 | Proof sent to secretariat or FDIS ballot initiated | Not dated | Not recorded |
| 50.60 | Close of voting. FDIS approved | Not dated | Not recorded |
| 60.00 | International Standard under publication | Not dated | Not recorded |
| 60.60 | International Standard published | Not dated | Not recorded; the planning date is an estimate |
What the page does not say
- No publication date is recorded. The last row is not a date.
- The abstract on the ISO page still describes the prior edition, guidance on ISO/IEC 27001:2013. The title names ISO/IEC 27001:2022. Treat the title as the current scope statement and the abstract as stale.
- No ballot close date is recorded for stage 40.20.
- No FDIS date is recorded.
What this means for a certificate
Nothing on this page changes a certificate. ISO/IEC 27001:2022 is the certifiable requirement. ISO/IEC 27003 is guidance on applying it. A guidance draft does not create a transition audit, does not extend a transition period and cannot be certified against. If a customer asks whether you are "27003 compliant", the honest answer is that the document is a draft and the requirement is 27001:2022.