Documented information — Control of documented information

Plain-language summary

Keeping ISMS documents and records available where needed, protected against loss of confidentiality, misuse and corruption, and managed through distribution, storage, change, retention and disposal — including documents from outside that you rely on.

What the clause is really asking

The clause asks for documented information to be at hand and fit for use wherever and whenever it is needed, and adequately protected — the standard names loss of confidentiality, improper use and loss of integrity, which for an ISMS is pointed: the risk register, the SoA, network diagrams and incident reports are themselves sensitive information and must be handled under your own classification scheme. It then lists the activities to address as applicable: distribution, access, retrieval and use; storage and preservation including legibility; control of changes such as version control; and retention and disposition. Documented information of external origin that the organisation needs — the standard itself, customer security schedules, supplier certificates, regulatory guidance — must be identified and controlled too. Retention matters doubly here: audit records and incident records have to survive for the certification cycle and for any legal timeline (POPIA s14 on retention, and the Regulator's expectations when it investigates a breach).

What auditors look for

Auditors test availability (can the shift supervisor find the incident procedure now?), protection (who can read the risk register; who can edit the SoA; are superseded versions removed from circulation?) and retention (show me the internal audit records from two years ago; show me the policy version in force at the time of that incident). They check external documents are identified and current — an expired supplier certificate or an old edition of a referenced standard on the shelf is a finding — and that records are protected against tampering, especially logs and incident evidence.

Typical evidence

Document control procedure or equivalent; access permissions on ISMS repositories matching classification; version control and change history; retention schedule for ISMS records aligned to legal and contractual requirements; disposal records; register of external documents (standards, customer requirements, supplier certificates, legislation) with currency checks; backups of the documentation repository.

How to comply — recommendations

Keep ISMS documents in one controlled repository with permissions set by role: everyone reads policies, the ISMS team edits, risk and incident records are restricted. Switch on version history and remove superseded versions from shared locations. Write a one-page retention schedule — audit records, management review minutes, incident records, training records, access logs — with retention periods justified by the certification cycle, contracts and law, and apply it. List your external documents with the date you last checked they were current. Back the repository up with the rest of your business records.

Common nonconformities

ISMS records (risk register, incident reports, network diagrams) accessible to people who do not need them; superseded versions still in use; no retention schedule, or records destroyed before the audit cycle or legal period ends; external documents (standards, customer requirements, supplier certificates) not identified or out of date; records lost with a departed employee's laptop or mailbox; no protection of records against alteration.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleDocument control for ISO 9001: numbering, versions and approvals
• ArticleThe ISO 9001 document numbering system, explained (with examples)
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadMaster Document RegisterThe register at the centre of document control: every controlled document with its number, owner, current revision, status and next review date.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free demoDocument-control demoA live register, revisions, approvals and an audit pack — no sign-up.