Answer
Does the ISO 18033-7 amendment apply to my ISMS?
It applies directly only if you use one of the five algorithms or cite the standard in a claim. Otherwise it is a monitoring item under the cryptography control in ISO/IEC 27001 Annex A 8.24, not a certification change.
The direct case
A direct obligation arises when a product, a supplier module or a claim depends on the standard. The five algorithm names are the population. If one of them appears in your inventory or your datasheet, the amendment changes a document you rely on, and the claim and the evidence need a review.
The indirect case
The ISMS control for cryptography asks for rules on how cryptography and its keys are used. A new edition of an algorithm standard is one of the changes those rules have to account for. That is a monitoring duty with a dated review, not an immediate technical change.
The no-action record
A reasoned no-action is a valid outcome, and it is easier to defend when it is written down. Record the question, the answer, the date and the owner. The free check produces exactly that text.
Check it yourself
The record is on the publication page. The base text is mapped on the contents page. The free check turns the answer into a dated decision record.
Source for this page
- ISO/IEC 18033-7:2022/DAmd 1, official record. Stage 40.60, Close of voting, edition 1, 8 pages, CHF 18, under development. Read live on 20 October 2026.
- The other sources behind this page are listed on sources.
Retrieved 2026-10-20. Our own statement, cited so you can check it.
Not legal advice; does not certify.