The new number is a draft
An FDIS cannot be cited as the applicable standard and cannot be certified against. If a contract cites edition 3 today, the citation is premature. What the record shows.
For the CISO, the ISMS manager and the consultant who advises them
The security governance standard, read from the board down.
ISO/IEC 27014 tells a governing body how to evaluate, direct, monitor and communicate the security of information. A new edition is at final draft stage, and its text is not public. This site states every clause of the edition in force, shows the evidence a board or an auditor asks for, and separates the recorded dates from the estimate.
Read from the real rules, not invented. Every answer points to the official clause behind it, so you can check any line yourself.
25 clause records110 evidence lines3 informative annexesFour marketsFree check, no account
No account for the free check. Not legal advice; does not certify.
ISO record, read 20 October 2026
ISO/IEC FDIS 27014
Edition 3, not published- Title
- Information security, cybersecurity and privacy protection, Governance of information security
- Edition
- Edition 3, replacing the 2020 edition
- Committee
- ISO/IEC JTC 1/SC 27, information security, cybersecurity and privacy protection
- Stage
- 50.60, close of voting, 12 August 2026
- In force today
- ISO/IEC 27014:2020, second edition
- Planning date
- 15 February 2027, an estimate
- 6Governance and management
- 7Six objectives and four processes
- 8The governing body and the ISMS
- AThe governance relationship
- BTypes of ISMS organization
- CExamples of communication
The edition 3 text is not public. The clause record follows the published 2020 edition. Read the record.
Know what applies, who answers for it, and when it changes.
Most boards can describe their security programme and cannot show the direction they set, the appetite they approved or the report they received. The register turns each clause into the evidence the board or the auditor will ask for, so the answer is ready before the question.
Photo: fauxels on Pexels, free licence.
01 / DRAFT
02 / SOURCE
The duties are published
ISO/IEC 27014:2020 is the edition in force, and its complete common text is public through ITU-T X.1054. The governance work can start now and will transfer to the new edition. The clause register.
03 / DATE
The date is an estimate
No publication date is recorded. The planning date used here is 15 February 2027, 120 days from the build date and labelled an estimate. ISO has not committed to it. The dated timeline.
Each page states the duty in our words, why it matters, the evidence a board or an auditor asks for, the common failures and what to do before publication. Start with clause 6.1 if the governance and management roles are blurred. Start with clause 7.2 if the board has no agreed objectives.
| Clause | Record | The answer in one line |
|---|---|---|
| 1 | Scope | It is guidance for the people at the top on how to govern the security of information, and it works whether the security work sits inside an ISO/IEC 27001 management system or outside one. |
| 2 | Normative references | Two standards hold the definitions and requirements the guidance leans on: ISO/IEC 27000 for vocabulary and ISO/IEC 27001 for the management system. |
| 3 | Terms and definitions | Four terms carry the whole model: the entity, the organization, the governing body and top management. The boundary between them is the point. |
| 4 | Abbreviations | Only two abbreviations are defined, ISMS and IT, and the second one matters because the governance of IT and the governance of information security are not the same thing. |
| 5 | Use and structure | The guidance describes how security governance works inside an ISO/IEC 27001 management system and how it connects to governance outside it, through four processes: evaluate, direct, monitor and communicate. |
| 6.1 | Overview: governance and management of information security | Governance sets direction and control from the top; management achieves the objectives that direction sets. Effective security needs both roles played consistently. |
| 6.2 | Governance activities within the scope of an ISMS | ISO/IEC 27001 does not use the word governance, but its clauses 4 to 10 are governance activities, and each one can be mapped to one or more of the six objectives. |
| 6.3 | Reference to the governance of IT | The guidance points to ISO/IEC 38500, the standard of guiding principles for governing bodies on the effective, efficient and acceptable use of information technology. |
| 6.4 | Thread of governance within the organization | Four threads run through the governance model: alignment, risk management, conflicts of interest, and preventing the organization technology from harming others. |
| 7.1 | Governance areas within an entity and the place of information security | Security is one governance area among several, and it has to align with the others rather than sit outside them or swallow them. |
The check asks which Annex B relationship you are in, which edition you cite, who the governing body is, whether the separation from management is real, how far the six objectives and four processes have got, and whether you are tracking the edition change. It returns the clause path, the weakest step and three actions. It runs in your browser and sends nothing anywhere.
It never returns a compliance verdict. It returns a reading of your answers and names the missing one when scope is incomplete. The clause behind each question is printed on the page.
What it will not do
No score, no certificate
It will not audit the entity, score governance maturity out of 100, or tell you that you conform. It will tell you which clause to open next and what evidence that clause expects.
The paid kit carries the full register, the evidence list and the dated plan.
| Date | What it is | Status | Source |
|---|---|---|---|
| 2026-03-17 | The 2020 edition is recorded as to be revised | Recorded | ISO page 74046 |
| 2026-03-25 | New project approved, then DIS approved for registration as an FDIS | Recorded | ISO page 94270 |
| 2026-08-12 | Stage 50.60, close of the FDIS vote | Recorded | ISO page 94270 |
| 2027-02-15 | Planning date for publication of edition 3 | Estimate, not an ISO commitment | This record, from stage 50.60 |
No approval decision at 50.99 and no publication date are recorded on the ISO page. A blank is not a prediction.
Obligation kit
USD 799 one off
The full register, the evidence list and a dated plan, in PDF, CSV and XLSX. Written for the entity you govern, with an owner and a due date on every line.
- 25 clause records and 3 annex notes
- 110 evidence lines, each tied to a clause
- 84 common failure lines with the fix
- A dated plan to the planning date, editable
- PDF, CSV and XLSX, no account needed to buy
One click to Stripe. The files unlock on the return page after payment.
Change watch
USD 49 a month
An email when the rule, its guidance or its dates change. The watch reads the same record the pages are built from.
- Stage and date changes on the ISO record
- Changes to the 2020 baseline or its common text
- A diff of what changed, in plain words
- Cancel any time from the Stripe receipt
One click to Stripe. No account to create.
The standard is guidance. The obligations around it are not. The rules page names the frameworks that matter to this buyer in the United States, the European Union, the United Kingdom and Australia, chosen by a scan of the frameworks the library covers for each market, in that order. Read the four market page.
Does ISO 27014 apply to my organization?
Yes, if you govern information security at the top of an organization of any size, whether the security work sits inside an ISO/IEC 27001 management system or outside one. It is guidance, so it does not certify. Run the free check.
Is the new edition published yet?
No. ISO records ISO/IEC FDIS 27014 at stage 50.60, close of voting, on 12 August 2026. A final draft is not a published standard and cannot be cited as the applicable edition. The planning date of 15 February 2027 is an estimate, not an ISO commitment.
What can I use today?
ISO/IEC 27014:2020, the second edition, published in December 2020 and corrected in April 2022. It is the edition in force and the baseline that edition 3 replaces. Every clause on this site is the 2020 clause, cited and stated in our own words.
What changes in edition 3?
The public record does not say. The ISO page publishes the stage and an abstract that describes the same four processes and the same audiences as the 2020 page. It does not publish the clause text. This site does not invent a change, and the watch emails the diff when the text becomes public.
What does the USD 799 kit contain?
The full 25 clause register, 110 evidence lines and a dated plan in PDF, CSV and XLSX, with an owner and a due date on every line. The labelled specimen shows the shape before you buy. The change watch is USD 49 a month.
Is this legal advice or a certification?
No. It is a reference and a working register. ISO/IEC 27014 is guidance and has no certification scheme. Nothing here decides whether your governance is lawful, adequate or complete, and nothing here replaces advice on your own entity.
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the register3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.