One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerEvery source, with what it supports
Each page cites the clause it comes from. This page lists the sources behind the record, the date each was read and the role each plays. The sources behind the clause register are listed here. The rules page names the frameworks it covers, with a link to each.
| Source | Link | Read | What it supports |
|---|---|---|---|
| ISO/IEC FDIS 27014, Information security, cybersecurity and privacy protection, Governance of information security ISO/IEC FDIS 27014, Edition 3, stage 50.60, 12 August 2026 | Open | 2026-10-20 | The ISO record for edition 3: designation, edition, committee, ICS, the stage history, the abstract and the replacement relationship. The FDIS text is not public and is not quoted. |
| ISO/IEC 27014:2020, Information security, cybersecurity and privacy protection, Governance of information security ISO/IEC 27014:2020, Edition 2, published December 2020, corrected version April 2022 | Open | 2026-10-20 | The published edition in force, and the baseline that edition 3 replaces. Its public page records the edition, the stage history, the abstract and the replacement notice. The clause record is written from the complete common text published by ITU-T. |
| ITU-T X.1054 (04/2021), Information security, cybersecurity and privacy protection, Governance of information security ITU-T Recommendation X.1054 (04/2021), the complete common text of ISO/IEC 27014:2020, 22 pages, clauses 1 to 8 and Annexes A to C | Open | 2026-09-21 | The free complete common text of the 2020 edition, published by ITU-T. Every clause entry is read against it and cited to the ISO clause number. The site states every requirement in its own words. |
| ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements ISO/IEC 27001:2022, Edition 3, published October 2022 | Open | 2026-10-20 | The management system standard whose clauses 4 to 10 the clause 6.2 matrix follows. The 2020 edition of 27014 mapped against the 2013 edition; the clause numbers persist in the 2022 edition. |
| ISO/IEC 38500:2015, Information technology, Governance of IT for the organization ISO/IEC 38500:2015 | Open | 2026-10-20 | The standard the clause 6.3 pointer names. The site does not restate its principles as requirements. |
| ISO stage codes ISO, stage codes for the development of an International Standard | Open | 2026-10-20 | The meaning of stage 50.60 and of the later publication stages. Used to read the stage record, not to predict a date. |
What is not a source
Secondary summaries, search snippets and memory are not sources. A clause answer that cannot be traced to the published text is not shipped. The site does not quote the edition 3 draft because the draft is not public, and it does not present a secondary reading as the standard.
How the record is verified
Each clause line was written from the complete common text of the 2020 edition and checked against the clause. The strict seven-word overlap test is run against the source and the prior edition before release. The ISO record is re-read on every refresh and the build fails on a change. The method in full.
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.