Key takeaways
- Create, update and control the documents and records the ISMS needs.
- The ISMS needs documented information to show it exists and works.
- Start here: identify documents required by the standard and those you need for effectiveness.
Purpose
Create, update and control the documents and records the ISMS needs.
Requirement
Requirement summaryThe organization’s information security management system shall include: a) documented information required by this document; and b) documented information determined by the organization as being necessary for the effectiveness of the information security management system. NOTE The extent of documented information for an information security management system can differ from one organization to another due to: 1) the size of organization and its type of activities, processes, products and services; 2) the complexity of processes and their interactions; and 3) the competence of persons.
Why it matters
The ISMS needs documented information to show it exists and works.
How to implement
- Identify documents required by the standard and those you need for effectiveness.
- Keep the set proportionate to your size.
- Maintain a document register.
- Review whether documents are still needed.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.5.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of the documents your security programme needs, including those required by the standard.
Records and examples to show
- Copies of those documents and required records (such as audit results and review minutes), kept and easy to find.
- Proof that records are kept for the time you decided.
Things you should be able to show or explain
- Be able to show where documents and records are stored.
How much to show: The full list.
Common mistakes
- Required documents missing.
- Records not kept.
- Missing mandatory documents.
- Too many documents nobody uses.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Document control procedure
FAQ
Can we exclude clause 7.5.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Version control, approval, access, retention.