Normative references
Two standards hold the definitions and requirements the guidance leans on: ISO/IEC 27000 for vocabulary and ISO/IEC 27001 for the management system.
This clause sets the scope, the vocabulary or the structure. It is guidance, not a requirement, and it is the base every later clause builds on.
What clause 2 asks
Only two documents are named as normative. One fixes the vocabulary the guidance uses; the other fixes the management system it describes. Both are cited as the edition current when this text was published, and the reader is warned that standards are revised. That warning is the practical point: a governance paper that names a standard without an edition cannot be audited later, because the reader cannot tell which definitions or clauses were in force. The draft of the next edition may name later editions, but that is not on the public record and is not assumed here.
Why it matters
A normative reference is a promise about meaning. If the reader and the writer hold different editions of ISO/IEC 27000, a term such as governing body or top management can carry a different boundary, and an argument about accountability becomes an argument about definitions. The same is true of ISO/IEC 27001: a clause number that moved between editions turns a cross-reference into a dead end. Recording the edition is cheap and it protects every later page of the record.
What good looks like
Keep a references table at the front of the governance pack. For each standard, record the designation, the edition, the date it was read and the clauses the organization relies on. When a standard is revised, mark the row as under review and do not silently swap the edition in a policy that the board has approved. Put the table under the same version control as the policies.
Evidence a board or an auditor asks for
The references table with editions and dates; the policy approval minute that names the editions in force; a note of any edition change and the review it triggered.
- Record The references table with editions and dates
- Record the policy approval minute that names the editions in force
- Record a note of any edition change and the review it triggered
Where it commonly fails
- A policy that cites ISO/IEC 27001 without an edition
- Two parts of the group relying on different editions of the vocabulary standard
- A cross-reference to a clause that moved in a later edition
What to do before publication
Before the edition 3 text is published, put clause 2 on the scope and foundations agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.