Documented information: general
The ISMS has to include both the documented information this standard requires and whatever further documented information the organization judges necessary for the ISMS to be effective.
What the requirement asks
The ISMS has to include both the documented information this standard requires and whatever further documented information the organization judges necessary for the ISMS to be effective. The note says the amount can vary with the size and type of organization, the complexity of processes and how they interact, and the competence of people.
What the guidance adds
The guidance separates information the standard requires from information the organization decides it needs. Both belong in the document control system, and the second set should be justified. A system that keeps everything 'just in case' becomes a liability in an audit.
Status of the guidance. The guidance lens for 7.5.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A list of documented information required by the standard (scope, policy, risk methodology, SoA, treatment plan, objectives, competence evidence, audit and review results and others) with its location with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Documented informationA list of documented information required by the standard (scope, policy, risk methodology, SoA, treatment plan, objectives, competence evidence, audit and review results and others) with its location
- Documented informationA list of additional documents the organization considers necessary
- Documented informationEvidence each required item exists and is current
- Documented informationRationale for the level of documentation chosen
The question an assessor will ask
An assessor will ask for A list of documented information required by the standard (scope, policy, risk methodology, SoA, treatment plan, objectives, competence evidence, audit and review results and others) with its location. The test for 7.5.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- One or more mandatory documents are missing, often the risk treatment results or competence evidence
- Excessive documentation nobody uses
- Documents are scattered with no overview
- Required retained records are not kept
Before the next audit
Before the next audit, test this against one live record: one or more mandatory documents are missing, often the risk treatment results or competence evidence.