One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerShort answers to the questions buyers actually ask
Each answer is written first for the reader who has one question and ninety seconds. The clause pages carry the detail. Every answer is in the page HTML, not behind a script or a form.
| Question | The answer in one paragraph |
|---|---|
| Does ISO 27014 apply to your organization? | It applies to any organization of any size that governs the security of information, whether the security work sits inside an ISO/IEC 27001 management system or outside one. It is written for the governing body and top management, and for the people who evaluate, direct and monitor the management system. It is guidance, not a certifiable requirement. |
| What is ISO/IEC 27014? | It is the international guidance on the governance of information security, developed by ISO/IEC JTC 1/SC 27. It gives a governing body concepts, six objectives and four processes for evaluating, directing, monitoring and communicating the security of information. The 2020 edition is in force and a third edition is at final draft stage. |
| When will the new ISO 27014 be published? | No publication date is recorded. ISO records stage 50.60, close of voting, on 12 August 2026 for edition 3. The approval decision and publication stages follow, but their dates are not on the public page. The 15 February 2027 date used here is a planning estimate, not an ISO commitment. |
| What changed in ISO 27014 edition 3? | No public clause change is recorded. The ISO page for edition 3 carries the same abstract and the same 13-page count as the page for the 2020 edition, and both name the same four processes and audiences. The clause text is not public, so this site does not claim an unseen change. When the text is available, the record is refreshed and the diff is sent. |
| How does ISO 27014 relate to ISO/IEC 27001? | ISO/IEC 27001 specifies the requirements for an information security management system. ISO/IEC 27014 gives guidance to the governing body on how to govern the security that the management system manages. They overlap at the risk process, the objectives and the reporting, but neither replaces the other. A management system can hold the governance record for each system it covers. |
| What is information security governance? | It is the means by which the governing body gives overall direction and control to the activities that affect the security of the organization information. It sets strategy and policy, monitors performance and evaluates proposals, while management delivers the objectives and reports on them. It is not the same as managing security, and it is not the same as governing technology. |
| What governance evidence does a board or an auditor ask for? | The role map with the governing body and top management, the six objectives with owners and evidence, the records of the four processes, the approved risk appetite with thresholds, the board reporting cadence and written response, and the charter of each management system with its scope and certification scope. Each clause page on this site lists the specific artefacts. |
| Is ISO/IEC 27014 certifiable? | No. It is guidance and there is no certification scheme for it. A certification body can certify an ISO/IEC 27001 management system, and an auditor can examine the governance record as evidence, but neither certifies the entity against ISO/IEC 27014. Any claim of a 27014 certificate is not supported by the standard. |
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.