The register is built from the sources below. The ISO page supplies the record and the dates. The ISO/IEC 27001:2022 and 27002:2022 records supply the requirement and the control guidance, in our own words. The prior edition supplies the comparison.
| Source | Link | What it is used for |
|---|---|---|
| ISO/IEC 27001:2022 | https://www.iso.org/standard/27001 | The certifiable requirement standard the draft explains. 30 clause records and 93 Annex A controls, held and paraphrased. |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/27002 | Implementation guidance for the 93 Annex A controls, held and paraphrased. |
| ISO/IEC 27003:2017 | https://www.iso.org/standard/63417.html | The prior edition, guidance on ISO/IEC 27001:2013. Held in part and used only for the comparison of editions. |
| ISO/IEC DIS 27003 stage record | https://www.iso.org/standard/85919.html | The official page, read on 20 October 2026: edition, stage, stage date, page count, committee and ICS. |
| Our guidance lens | https://iso-27003-revision-checker.theartofservice.com/methodology/ | Our own statement of what the draft asks a team to do, written from the held records. Not a quotation. |
What is not in the record
The DIS body is not public and is not held. This site does not quote it, summarise it as if it had read it, or infer its wording from the title. When the published text is available, the record is extended from it and the changelog records the change.
All links are checked before deployment. A source link that does not resolve is a build failure.