Everything you need to know
Security and customers first

Request a demo

Find out today the difference that Hicomply’s unique solution can make to your business.


Thank you for your request


In the meantime, connect with Hicomply for insights on authentication and fraud prevention


ROI Calculator

See how much you could save with Hicomply

Hicomply feature Yearly saving
Automated scoping Easily scope your ISMS with the Hicomply platform
Asset register autogeneration A shorter learning curve for organisations and a simplified process
Risk assessment Autogenerate your risk register and risk treatment plan
Extended policy templates 90% of the essential are already written out of the box
Controls framework All controls are pre-loaded and already linked to the risks they mitigate
Task management Automate all actions, administration and setup time of your ISMS
Real time monitoring Understand status and progress across your ISMS with the Hicomply dashboard
Compliance & Training Your whole team, on the same page
Audit readiness Hicomply makes sure you have everything in place for your audit
Auditor access Give auditors a dedicated login to access and audit your ISM
Back to Resource Hub

ISO 27001 Clause 7.5: Documented Information

7.5.1 General

This clause requires the organisation to include documented information required by the standard as well as any other documented information required by the organisation for the effectiveness of the ISMS. It should also be noted that the extent of the documented information may vary from organisation to organisation. It depends on the size, type of activities, products, complexity of processes and their interactions etc.

7.5.2 Creating and updating

This documented information may need a change or an update as a result of the continual improvement nature of the ISMS. The standard requires the organisation to ensure that the newly created or updated document must have proper identification and description (i.e. title, date, author or reference number etc.), appropriate format and media (paper or electronic).

All the new or updated documents must go through proper review and approval procedures to ensure that they are ready to be implemented in the organisation.

7.5.3 Control of documented information

According to this clause, all the documented information required by the ISMS and the standard itself must be available in a proper format where and when needed. The organisation must ensure that all the documented information must be protected so that the integrity and confidentiality of the information cannot be negatively affected.

For effective control of documented information, the organisation must consider activities like distribution, access, retrieval and use of the documented information, storage and preservation. This includes the preservation of legibility, control of changes (e.g. version control) and retention and disposition.

Mandatory Documented Information

  1. ISMS Scope (Documents) Clause 4.3
  2. High-level information security policy (Documents) Clause 5.2
  3. Risk Assessment Methodology (Documents) Clause 6.1.2
  4. Risk Assessment Report and Risk Treatments (Record) Clause 6.1.2, Clause 6.1.3, Clause 8.2, Clause 8.3
  5. Statement of Applicability (Documents) Clause 6.1.3 d)
  6. information security objectives (Documents) Clause 6.2
  7. Evidence of competencies (Record) Clause 7.2
  8. Documented information as required by the ISMS (Documents and Record) Clause 7.5.1 b)
  9. Documents and records required by ISO 27001 (Documents and Record) Clause 7.5.1 a)
  10. Monitoring and measurement results. (Record) Clause 9.1
  11. Internal audit program aid results. (Record) Clause 9.2
  12. Results of management review (Record) Clause 9.3
  13. Non-conformances and results and corrective action (Record) Clause 10.1

More Resource Hub

NIST Controls For Supply Chain Risk Management
ISO 9001 Hub
NIST 800-53 Hub