Do not wait for the new label
The published edition is readable now. The role map, the objectives, the process cycle and the board reporting take months, and they are the same work under either edition.
What is recorded, what is derived, and what is an estimate
ISO/IEC FDIS 27014 is edition 3 and it is at stage 50.60: the FDIS ballot has closed and the proof has come back to the secretariat. It is not a published standard. This page separates the recorded facts from the planning estimate, because the difference decides what you can put in a policy or a contract.
| Field | Public record | Source |
|---|---|---|
| Designation | ISO/IEC FDIS 27014, Edition 3 | ISO page 94270 |
| Title | Information security, cybersecurity and privacy protection, Governance of information security | ISO page |
| Committee | ISO/IEC JTC 1/SC 27, information security, cybersecurity and privacy protection | ISO page |
| ICS | 35.030, IT Security | ISO page |
| Stage | 50.60, Close of voting. Proof returned by secretariat | ISO page |
| Stage date | 12 August 2026 | ISO page |
| Replaces | ISO/IEC 27014:2020, second edition, published December 2020, corrected April 2022 | ISO page 94270 and 74046 |
| Edition in force | ISO/IEC 27014:2020, the edition this record follows | ISO page 74046 |
| FDIS text | Not public. ISO's page carries the record and a preview, not the clauses. | ISO page |
| Publication | Not recorded. The planning date of 15 February 2027 is an estimate for this site. | This record |
Every date in this table is recorded on an ISO page. Later stages are not recorded, so the table leaves them blank. A blank is not a prediction and it is not a date. The planning date is a separate, labelled estimate.
| Stage | What it means | Date | Status |
|---|---|---|---|
| 10.99 | New project approved | 2026-03-25 | Recorded on the ISO page for 94270 |
| 40.99 | Full report circulated: DIS approved for registration as FDIS | 2026-03-25 | Recorded on the ISO page for 94270 |
| 50.00 | Final text received or FDIS registered for formal approval | 2026-05-22 | Recorded on the ISO page for 94270 |
| 50.20 | Proof sent to secretariat or FDIS ballot initiated: 8 weeks | 2026-06-16 | Recorded on the ISO page for 94270 |
| 50.60 | Close of voting. Proof returned by secretariat | 2026-08-12 | Recorded on the ISO page; current stage |
| 50.99 | FDIS or proof approved for publication | Not recorded | Not recorded |
| 60.00 | International Standard under publication | Not recorded | Not recorded |
| 60.60 | International Standard published | Not recorded | Not recorded; the planning date is an estimate |
| 90.92 | International Standard to be revised (2020 edition) | 2026-03-17 | Recorded on the ISO page for 74046 |
ISO/IEC 27014:2020 is published and it is the edition a policy can cite today. Its complete common text is published by ITU-T as Recommendation X.1054 (04/2021), free of charge, and it carries clauses 1 to 8 and Annexes A to C. This site reads every clause against that text and cites the ISO clause number. The edition 3 public page carries the same abstract and the same page count as the 2020 page. That is evidence of continuity at the level of the abstract. It is not evidence that a clause is unchanged, and this site does not claim one.
What this means for a contract. A contract written today should cite ISO/IEC 27014:2020 if it needs a published edition. A clause that cites edition 3 cites a final draft. The draft may change before publication, and a draft cannot be certified against.
01
02
Do not cite a draft
An FDIS is not the applicable standard. If a customer asks for the new edition today, say that it is at 50.60 and offer the published edition and your evidence.
03
Watch the record, not the rumour
The approval decision at 50.99 and the publication date are not recorded. The watch emails when the record changes, with the diff. The planning date is an estimate.
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the register3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.