One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerThis is a specimen, not your record. It shows three rows from the register with the columns the kit adds: the evidence, the owner, the status. The free pages show every clause in full; the kit adds the working columns and the consolidated files.
Specimen, not live data
| Clause | Record | Duty, in our words | Evidence | Owner | Status |
|---|---|---|---|---|---|
| 6.1 | Overview: governance and management | Separate the direction, monitoring and evaluation the governing body does from the proposals, delivery and reporting management does, and show where each happens. | Terms of reference, four board agendas with the items marked | Board secretary | Open |
| 7.2.2 | Risk-based decisions | State the risk appetite with thresholds for financial, operational, compliance and reputational consequences, get it approved, and map five security risks into the entity register. | Approved appetite, five mapped risks, resource decisions | Risk lead | Open |
| 7.3.4 | Monitor | Put the effectiveness report, the conformance position and new developments on a fixed board cadence, and record the priorities the board sends back. | Report pack, written board response, alert route | CISO | Open |
| When | Clause | What is produced | Owner | Status |
|---|---|---|---|---|
| Week 1 | 6.1 | Role map and separation arrangement | Board secretary | Open |
| Week 3 | 7.2.2 | Risk appetite with thresholds and mapped risks | Risk lead | Open |
| Week 7 | 7.3.4 | Fixed board cadence and written response | CISO | Open |
clause,title,kind,group,citation,requirement,evidence_categories,evidence_artefacts,probe,gaps,prepare,owner,status,due_date,evidence_pointer,source_url,retrieved_at
Buy the kit, USD 799 Read the free register Download the sample CSV
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerAnnexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesStage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.