Guide

ISO 27001 documentation

ISO 27001 asks for documented information in specific places. Some documents are explicitly required, others become necessary once you apply the related Annex A controls. Here is what you need, and how to keep it lean.

• Mandatory documents from clauses 4 to 10
• Records auditors will sample
• Annex A documents most organisations need

Mandatory documents

• ISMS scope (4.3)
• Information security policy (5.2)
• Risk assessment process (6.1.2)
• Risk treatment process (6.1.3)
• Statement of Applicability (6.1.3 d)
• Information security objectives (6.2)
• Documented information needed for operational planning and control (8.1)

Mandatory records

• Evidence of competence (7.2)
• Risk assessment results (8.2)
• Risk treatment results (8.3)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2)
• Management review results (9.3)
• Nonconformities and corrective actions (10.2)

Annex A documents most organisations need

• Acceptable use and asset inventory
• Access control policy
• Supplier security requirements
• Incident management procedure
• Business continuity arrangements
• Backup and cryptography rules

Keeping it lean

Documents should describe what you actually do. Short, owned and reviewed documents beat long templates. Auditors care that people follow them and that records prove it.

Next steps

1. Start with the mandatory set. Scope, policy, risk method, Statement of Applicability and objectives.
2. Add what your controls need. Write only the Annex A documents your applied controls require.
3. Control and evidence. Version, approve and review documents, and keep the records they generate.

Frequently asked questions

Can we use templates?

Yes, as a starting point. Tailor them to how you actually work, because auditors test practice against the document.

Do documents need to be on paper?

No. Documented information can be in any format or system, as long as it is controlled.

Related guides

• ISO 27001 requirements guide, What the ISO/IEC 27001 standard requires, how Annex A works and how certification runs.
• ISO 27001 risk assessment, A step by step method for the information security risk assessment and treatment plan.
• ISO 27001 checklist, Check each clause and control against your evidence.

Control ISMS documents in one place

Version, approve and review policies and records, with A.I. mapping documents to clauses and Annex A controls for your team to confirm.