7.5.1 General

This clause requires the organisation to include documented information required by the standard as well as any other documented information required by the organisation for the effectiveness of the ISMS. It should also be noted that the extent of the documented information may vary from organisation to organisation. It depends on the size, type of activities, products, complexity of processes and their interactions etc.

7.5.2 Creating and updating

This documented information may need a change or an update as a result of the continual improvement nature of the ISMS. The standard requires the organisation to ensure that the newly created or updated document must have proper identification and description (i.e. title, date, author or reference number etc.), appropriate format and media (paper or electronic).

All the new or updated documents must go through proper review and approval procedures to ensure that they are ready to be implemented in the organisation.

7.5.3 Control of documented information

According to this clause, all the documented information required by the ISMS and the standard itself must be available in a proper format where and when needed. The organisation must ensure that all the documented information must be protected so that the integrity and confidentiality of the information cannot be negatively affected.

For effective control of documented information, the organisation must consider activities like distribution, access, retrieval and use of the documented information, storage and preservation. This includes the preservation of legibility, control of changes (e.g. version control) and retention and disposition.

Mandatory Documented Information

1. ISMS Scope (Documents) Clause 4.3
2. High-level information security policy (Documents) Clause 5.2
3. Risk Assessment Methodology (Documents) Clause 6.1.2
4. Risk Assessment Report and Risk Treatments (Record) Clause 6.1.2, Clause 6.1.3, Clause 8.2, Clause 8.3
5. Statement of Applicability (Documents) Clause 6.1.3 d)
6. information security objectives (Documents) Clause 6.2
7. Evidence of competencies (Record) Clause 7.2
8. Documented information as required by the ISMS (Documents and Record) Clause 7.5.1 b)
9. Documents and records required by ISO 27001 (Documents and Record) Clause 7.5.1 a)
10. Monitoring and measurement results. (Record) Clause 9.1
11. Internal audit program aid results. (Record) Clause 9.2
12. Results of management review (Record) Clause 9.3
13. Non-conformances and results and corrective action (Record) Clause 10.1