Clause 2: Normative references

What the clause requires

The base standard states that it has no normative references. The amendment record does not state whether the amendment adds any.

What the public text does not state

• Whether the amendment adds a normative reference
• The amendment body

What it means for you

A clause that says there are no normative references is not empty. It tells the reader that the document stands on its own definitions and does not incorporate another standard by reference. That matters when you map it into a control framework: there is no second document you must also hold in order to read this one.

The amendment is a different case. Its record is a catalogue entry, not a text, and it does not say whether the amendment adds a reference to another part of the 18033 series or to a test method. Until the published text arrives, the honest answer is that the amendment s normative references are not stated in the record.

For the buyer this is a small clause with a practical use. When a supplier says its implementation follows the standard, you can ask for the standard alone and not a chain of incorporated documents. If the amendment later adds a reference, that answer changes, which is exactly the kind of change the watch is for.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
A note in the crypto inventory that the standard is self-contained, with the retrieval date	ISMS manager	Records the basis on which the mapping was made.
The published amendment text, once available, checked for a new clause 2	Standards owner	The only way to replace "not stated" with a fact.

How to verify it

Open the base standard clause 2 and confirm the sentence. If a supplier cites a normative reference that the standard does not contain, ask where it comes from.

Dates

The kit plan for clause 2 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• 1 Scope
• B Annex B, Object identifiers

Where this comes from