One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerWhat is ISO/IEC 27014?
It is the international guidance on the governance of information security, developed by ISO/IEC JTC 1/SC 27. It gives a governing body concepts, six objectives and four processes for evaluating, directing, monitoring and communicating the security of information. The 2020 edition is in force and a third edition is at final draft stage.
Last updated: . Written from the published edition and the ISO record. Not legal advice; does not certify.
What the designation means
ISO/IEC 27014 is an International Standard in the ISO/IEC 27000 family. It is guidance rather than a requirements standard, so its clauses use should rather than shall. The current edition is the second, published in December 2020 and corrected in April 2022. A third edition is at stage 50.60, close of voting, and is not published.
What it covers
The concepts of governance and management, the governance activities already present in an ISO/IEC 27001 management system, the place of security among the entity governance areas, six governance objectives and four processes. It also covers the governing body requirements on the management system, including three types of relationship between an entity and its management system organization.
What it does not cover
It does not give a control catalogue, a certification scheme or a maturity score. It does not decide the legal duties of the entity. It does not replace ISO/IEC 27001, and a management system can be certified while the governance conversation is still thin.
Why the edition change matters
A new edition is in the approval phase. The public record does not publish the clause text, so the changes cannot be read yet. The governance work in the 2020 edition is in force now and will transfer, which is why this site builds the register on the published edition and tracks the record.
Related clauses
- 1 Scope
- 5 Use and structure
- 6.1 Overview: governance and management of information security
- 7.3.1 General
Questions
Who writes it?
ISO/IEC JTC 1/SC 27, the committee for information security, cybersecurity and privacy protection. Its secretariat is held by DIN.
Is it the same as ISO/IEC 27001?
No. 27001 is the requirements standard for a management system. 27014 is the guidance for the governing body on how to govern the security that the management system manages.
Can I read it for free?
The complete common text of the 2020 edition is published by ITU-T as Recommendation X.1054 (04/2021). This site links that text and states the clauses in its own words.
Run the free check / Open the register / The kit and the watch
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.