Home / Free check
Does the ISO 18033-7 amendment apply to you?
Six questions. The result is computed in your browser from the record dates and the scope rules, never sent to a server. It names the band, the reason, the dated actions and anything still missing.
Your result appears here
Answer the six questions and press Run the check. The result names the band, the reason, the dated actions and what is still missing.
How the bands work
| Band | Result | What it means |
|---|---|---|
| A | In scope, act | At least one product uses one of the five algorithms or a claim already cites the standard. The amendment will change the document you cite, so the claim and the inventory need a review before publication. |
| B | Adjacent, check the module | A third party supplies the primitive and no claim cites the standard. The work is a supplier question and a record, not a re-engineering project. |
| C | Monitor, ISMS only | No use and no claim were reported. The clause 5 requirements still apply to any future use, and the ISMS control still needs a dated review. |
| D | Gap, build the inventory | No use was reported, but the inventory does not record the algorithm, key length, tweak length and standard version. That gap is worth closing before the amendment publishes, because you cannot answer the scope question without it. |
| X | Scope incomplete | A critical answer is missing or unsure. The tool will not default to the lighter pathway. Answer the named question and run it again. |
The dates the check uses
Every date is computed from the estimated publication date of 15 September 2027. The estimate is ours, from ISO stage 40.60; the ISO record states no date. If the stage moves, the plan moves.
| Point | Date | What happens |
|---|---|---|
| T-270 | 19 December 2026 | Confirm the population. Search product documentation, supplier lists and open tenders for the standard and for the five algorithm names. Record what you find, including nothing. |
| T-180 | 19 March 2027 | Update the inventory and the supplier questions. Add the four fields to the crypto inventory and send the supplier question to every module supplier that offers a tweakable block cipher. |
| T-90 | 17 June 2027 | Line up the evidence. Collect the known-answer test, the configuration record, the key length, the tweak policy and the data bound for any Skinny-64/192 use. Decide whether a security target or datasheet needs a new version. |
| T-30 | 16 August 2027 | Confirm the publication. Check the ISO record and the published text. Compare the published amendment with the DIS you planned against, and list every clause that changed. |
| PUB | 15 September 2027 | Publication day. Reissue the controlled documents and the register, update the version in every claim, and close the decision record. |
| PUB+30 | 15 October 2027 | Close the loop. Record the decision, the evidence and the next review date. Tell the supplier and the certification body if the claim changed. |
What the check does not do
It does not test an implementation, certify an organisation, copy the amendment text, or give legal advice. It does not know what is in your systems; it knows what you told it. The result is only as good as the six answers, which is why a Not sure answer produces a named gap rather than a lighter band.
Source for this page
- ISO/IEC 18033-7:2022/DAmd 1, official record. Stage 40.60, Close of voting, edition 1, 8 pages, CHF 18, under development. Read live on 20 October 2026.
- The other sources behind this page are listed on sources.
Retrieved 2026-10-20. Our own statement, cited so you can check it.