Documented information — Creating and updating
Plain-language summary
When ISMS documents are created or changed, giving them proper identification, a suitable format and medium, and a review and approval step so people can trust what they are reading.
What the clause is really asking
Three housekeeping requirements with real security consequences. Identification and description: a title, a date, an author, a reference number — so the incident procedure in use is unambiguously the current one. Format and media: language, software version, graphics, paper or electronic — so a runbook needed during an outage is readable when the network is down. Review and approval for suitability and adequacy: someone competent read it and someone with authority signed it. For an ISMS, the approval step is also a control: an access-control policy approved by a junior administrator is a governance gap, and auditors expect approval authority to match the document's weight. Organisations with ISO 9001 already do this; the only addition is to make sure security documents go through the same gate, including those produced by IT outside the quality system.
What auditors look for
Auditors sample documents in use — on the intranet, in the ticketing tool, pinned in the server room — and check for identification, version, date and approval. They compare the version in use with the version in the register. They ask who approved the policy and whether that person had the authority, and they check that a document everyone cites (the incident runbook) is available in a form that works during the incident it describes. Unapproved drafts in circulation are a frequent finding.
Typical evidence
Document register with version, date, author and approver; documents carrying identification and version in header or footer; approval records (signatures, workflow approvals); defined approval authorities for document types; evidence that formats suit use (offline copies of incident and continuity documents).
How to comply — recommendations
Use one template with a standard header — title, document code, version, date, owner, approver — and one approval rule: policies by top management, procedures by the process owner and the ISMS lead, forms by the process owner. Run approvals through the tool you already have (document management, SharePoint workflow, even a signed PDF). Keep an offline copy of the incident response and continuity documents. If you hold ISO 9001, simply add the ISMS documents to the existing document control procedure and register — the Qlause Master Document Register template already carries the fields.
Common nonconformities
Documents in use without version, date or approver; approval by someone without appropriate authority; several versions of the same document in circulation; ISMS documents produced by IT outside the organisation's document control; incident or continuity documents available only on systems that would be down in the incident.
Related clauses
ISO 27001 7.5.1, 7.5.3, 5.3 (authorities); Annex A 5.1 (policies approved by management and communicated), 5.37 (documented operating procedures); ISO 9001 7.5.2 (identical requirement — one document-control procedure for both).
Resources for this clause
- ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
- ArticleDocument control for ISO 9001: numbering, versions and approvals
- ArticleThe ISO 9001 document numbering system, explained (with examples)
- Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
- Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
- Free downloadMaster Document RegisterThe register at the centre of document control: every controlled document with its number, owner, current revision, status and next review date.
- Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
- Free demoDocument-control demoA live register, revisions, approvals and an audit pack — no sign-up.
Get the free ISO 27001:2022 Gap Analysis Checklist
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.