Documented information: control
Documented information required by the ISMS and by the standard must be controlled so that it is available and fit for use where and when needed and is suitably protected, for example against loss of confidentiality, misuse or loss of....
What the requirement asks
Documented information required by the ISMS and by the standard must be controlled so that it is available and fit for use where and when needed and is suitably protected, for example against loss of confidentiality, misuse or loss of integrity. As applicable, the organization addresses distribution, access, retrieval and use; storage and preservation including keeping it legible; control of changes such as version control; and retention and disposition. External documented information the organization needs for planning and operating the ISMS is identified as appropriate and controlled. A note explains that access can mean permission only to view, or also the right to edit.
What the guidance adds
Control of documented information covers availability, protection, distribution, access, retrieval, retention and disposal. The guidance asks the organization to show what happens at each stage, including what happens when a person leaves or a system is retired. The register is the evidence.
Status of the guidance. The guidance lens for 7.5.3 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A document control procedure covering distribution, access, storage, version control, retention and disposal with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Document controlA document control procedure covering distribution, access, storage, version control, retention and disposal
- Document controlAccess permissions on the document repository showing view and edit rights
- Document controlVersion histories and change records for ISMS documents
- Document controlA register of external documents such as standards and regulations used by the ISMS
The question an assessor will ask
An assessor will ask for A document control procedure covering distribution, access, storage, version control, retention and disposal. The test for 7.5.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Obsolete versions remain accessible and in use
- Access to ISMS records is not restricted
- Retention periods for records are undefined
- External documents are not identified or kept current
Before the next audit
Before the next audit, test this against one live record: obsolete versions remain accessible and in use.