Documented information — General

Plain-language summary

Having the documents and records the standard explicitly requires, plus whatever your organisation decides it needs for the ISMS to work — scaled to your size, your activities and the competence of your people.

What the clause is really asking

The standard distinguishes two sets of documented information: what it requires, and what the organisation determines is necessary for the ISMS to be effective. The required set is finite and worth knowing by heart: the scope (4.3), the policy (5.2), the risk assessment and treatment processes (6.1.2, 6.1.3), the Statement of Applicability and risk treatment plan (6.1.3), the objectives (6.2), evidence of competence (7.2), the documented information needed for operational confidence (8.1), the results of risk assessments and treatment (8.2, 8.3), monitoring and measurement results (9.1), the audit programme and results (9.2), management review results (9.3) and the nature of nonconformities, the actions taken and the results of corrective action (10.2). Annex A controls then imply further documents where the control applies — the asset inventory, acceptable use rules, the incident response procedure, operating procedures, logs. The clause reminds you that extent depends on your size and complexity: a 40-person firm's ISMS can fit in a dozen documents and a handful of registers. If you run ISO 9001, you already have the document-control machinery — register ISMS documents in it.

What auditors look for

Auditors carry the list of mandatory documented information and tick it off at Stage 1; a missing item there is a straight nonconformity. Then they look at proportionality and use: are the procedures ones people actually follow, or shelf-ware; are the records real and dated; does the organisation know which documents are its own choice and why? They also look for over-documentation — forty policies nobody has read is a finding in disguise, because 7.3 and 7.5.3 then fail.

Typical evidence

A document register listing the mandatory documented information with its location and status, plus the organisation's own documents; the documents themselves, controlled; records (registers, logs, minutes, results) retained per 7.5.3; a rationale for the extent of documentation relative to size and complexity.

How to comply — recommendations

Start with the mandatory list and make each item a line in your document register with a document code, owner and location. Add only the documents you need to operate — if a process runs reliably without a procedure, a short work instruction may be enough. Reuse the ISO 9001 numbering scheme if you have one (QM for manual and policies, QP for procedures, FM for forms and registers). Keep records where the work happens — ticketing system, HR system, the risk workbook — and tell the register where to find them rather than copying them into a folder before audits.

Common nonconformities

One or more mandatory documents missing (most often the SoA, the risk treatment plan, the audit programme or monitoring results); documentation disproportionate to the organisation (template libraries nobody uses); documents and records with no identified owner or location; the organisation unable to say which documented information it decided it needed and why.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleDocument control for ISO 9001: numbering, versions and approvals
• ArticleThe ISO 9001 document numbering system, explained (with examples)
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadMaster Document RegisterThe register at the centre of document control: every controlled document with its number, owner, current revision, status and next review date.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free demoDocument-control demoA live register, revisions, approvals and an audit pack — no sign-up.