Free check

What applies, who answers, and how far the record has got

Answer nine questions about the entity and its governance record. The check returns a reading, the clause path that applies, the weakest step, three actions and a date reading. It runs in your browser and sends nothing anywhere. It is a reading of your answers, not a compliance result.

Which relationship is your entity to the ISMS organization? Type A is the same, Type B is part of a larger entity, Type C is one ISMS shared by several entities. Annex B.

Which edition does your policy or contract cite? The published edition is 2020. Edition 3 is a final draft at stage 50.60.

Are the governing body and top management named and dated? The four terms in clause 3 decide who is accountable and who reports to whom.

Is the split between governance and management written down and tested? Direction, monitoring and evaluation on one side; proposals, delivery and reporting on the other.

How far have the six governance objectives got? Each objective needs an owner and evidence. Clauses 7.2.1 to 7.2.6.

How many of the four processes have a meeting, an input and a record? Evaluate, direct, monitor and communicate. Clauses 7.3.2 to 7.3.5.

Is the risk appetite approved with thresholds? An appetite without thresholds cannot settle a decision. Clauses 7.2.2 and 7.3.3.

How does the governing body receive security performance? A fixed cadence with a written response is the monitor process under clause 7.3.4.

Is the edition change tracked with an owner and a review date? The work in the 2020 edition is in force now; the new edition is at final draft stage.

Your own review dateThe site uses 15 February 2027 as an estimate. Put your own date here; the plan is yours.

Blank answers return "scope incomplete" and name what is missing. The check never assumes the lighter pathway.

JavaScript is off. The check needs JavaScript to compute the reading. You can still read the clause register and the dated plan. The nine questions are: the Annex B relationship; the edition you cite; whether the governing body and top management are named; whether the governance and management split is tested; how far the six objectives have got; how many of the four processes operate; whether the risk appetite is approved with thresholds; how the governing body receives performance; and whether the edition change is tracked.

The answer today

ISO/IEC 27014:2020 is the edition in force

It is the published edition and the baseline that edition 3 replaces. The clause path below is the same under either edition, and a final draft is not a published standard, so the check never calls anything conformant.

How the dates are used

The ISO page records stage 50.60 on 12 August 2026. No publication date is recorded. The planning date of 15 February 2027 is an estimate for this site, not an ISO commitment. Your own date replaces it in the result and the plan.

THE RULE

What each question applies

The clause

Input	How it is used	Source
Relationship	Type B raises the alignment and membership questions; Type C adds the mutual objectives and the assurance route. An unsure answer returns scope incomplete.	Annex B, 8.2
Edition	An FDIS or edition 3 citation is flagged: a draft is not the applicable standard.	Clause 1, ISO record
Role map	An unnamed governing body cannot receive the report the monitor process requires.	Clauses 3, 6.1, 8.1
Separation	A separation that has never changed a decision is treated as a gap, not as comfort.	Clause 6.1, Annex B
Objectives	A partial map leaves the board unable to see the whole position.	Clauses 7.2.1 to 7.2.6
Processes	A cycle with a missing process is not a cycle. The weakest one drives the reading.	Clauses 7.3.2 to 7.3.5
Appetite	No approved appetite means the risk decisions have no scale.	Clauses 7.2.2, 7.3.3
Reporting	Ad hoc reporting is a monitoring gap, even where the reports are good.	Clause 7.3.4
Transition	No owner means the edition change will arrive as a surprise.	ISO record, clause 8.1

A blank or impossible answer returns "scope incomplete" and names the missing item. The check never guesses a lighter pathway.

THE RULES THIS IS BUILT FROM

Read from the real rules, not invented

Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.

25 CLAUSES

One page per clause

The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.

Open the register

3 ANNEXES

Guidance, clearly labelled

Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.

Open the annexes

ONE STAGE RECORD

No invented date

Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.

Read the record

The edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.

The check is a reading of your answers, not an audit and not a compliance result. It does not decide whether the governance is lawful, adequate or complete. It does not certify anything and it is not legal advice.