This is a common point of confusion because in the ISO 27000 series.

They are looking for guidelines on auditing information security controls — specifically the controls listed in ISO/IEC 27001 (Annex A) and ISO/IEC 27002 .

| Source | Link | Format | Cost (approx.) | |--------|------|--------|----------------| | ISO Store | iso.org (for 27007) | PDF + Paper | CHF 118–198 | | ANSI Webstore | webstore.ansi.org | PDF | $120–$180 | | IHS Markit | ihs.com | PDF | Varies | | National body (e.g., BSI, DIN, JSA) | Your country’s ISO member | PDF | ~$100–$200 |