ISO 27001:2022 Clause 7.5 sets the rules for documented information in an information security management system (ISMS): the documents and records the standard itself requires, plus any others the organisation decides it needs for the ISMS to work. The clause covers what must be documented, how documents are created and updated, and how they are controlled through to disposal.
What documented information does ISO 27001:2022 require?
ISO 27001:2022 names a fixed set of documented information in Clauses 4 to 10. Some of it describes how the ISMS works and is kept up to date (documents). The rest shows what happened, such as results and decisions, and is kept as evidence (records). For a plain-English meaning of the term, see our documented information definition.
| Documented information | Clause | Document or record |
|---|---|---|
| Scope of the ISMS | 4.3 | Document |
| Information security policy | 5.2 | Document |
| Information security risk assessment process | 6.1.2 | Document |
| Information security risk treatment process | 6.1.3 | Document |
| Statement of Applicability (SoA) | 6.1.3 d) | Document |
| Information security objectives | 6.2 | Document |
| Evidence of competence | 7.2 d) | Record |
| Information showing processes have been carried out as planned | 8.1 | Record |
| Results of information security risk assessments | 8.2 | Record |
| Results of information security risk treatment | 8.3 | Record |
| Results of monitoring and measurement | 9.1 | Record |
| Internal audit programme and audit results | 9.2.2 | Record |
| Results of management reviews | 9.3.3 | Record |
| Nonconformities, actions taken and results of corrective action | 10.2 | Record |
Two points are easy to miss. Clause 8.1 asks for documented information only “to the extent necessary” to show processes ran as planned, so how much you keep is your decision. And Clause 7.3 (awareness) does not itself ask for documented information, even though many organisations keep training and awareness records alongside the evidence of competence required by Clause 7.2.
Required documents are only the starting point
Clause 7.5.1 adds any documented information the organisation decides is necessary for the ISMS to be effective. The standard notes that this amount differs between organisations, depending on their size and activities, how complex their processes are and how competent their people are.
Annex A controls you include in your Statement of Applicability can add more. For example, control 5.37 asks for documented operating procedures for information processing facilities, available to the staff who need them.
Book a demoWhat does Clause 7.5 require?
Clause 7.5 has three parts. Each one answers a different question about your documents and records.
Clause 7.5.1 General: what must be documented?
The ISMS must include the documented information ISO 27001:2022 requires (the list above) and any further documented information the organisation decides is needed for the ISMS to be effective. A small organisation with simple processes may need far less than a large one.
Clause 7.5.2 Creating and updating: how should documents be made?
When documented information is created or updated, the organisation makes sure it has:
- Identification and description: for example a title, date, author or reference number.
- A suitable format and media: for example the language and software version, on paper or in electronic form.
- Review and approval: someone checks it is suitable and adequate.
Clause 7.5.3 Control: how are documents kept under control?
Documented information must be available and fit to use where and when it is needed, and protected against loss of confidentiality, improper use and loss of integrity. To do that, the organisation deals with distribution, access, retrieval and use; storing and preserving documents, including keeping them readable; control of changes, such as version control; and retention and disposal. Documents from outside the organisation that the ISMS relies on are identified and controlled too.
For a step-by-step approach, see how to implement ISO 27001 Clause 7.5, and our guide to control of documented information under Clause 7.5.3.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
How do you keep documented information under control?
A practical way to meet Clauses 7.5.2 and 7.5.3 is to treat every document and record as having a lifecycle, from creation to disposal. Six steps cover it.
-
Identify each document and name an owner. Give every document a title, date, version and reference so it can be found and told apart. Clause 7.5 does not require a named owner, but assigning one makes it clear who keeps each document current.
-
Standardise format and storage. Use one structure and one central place, rather than files spread across inboxes, personal drives and old shared folders.
-
Review and approve before use. Schedule reviews, record who approved each version and when, and link documents to the controls they support.
-
Control access and distribution. Decide who can only view a document and who can view and change it, and keep a log of who did what.
-
Control changes. Keep a version history that shows who changed what, when and why, so earlier versions can be compared or restored.
-
Set retention and disposal. Decide how long each type of record is kept, keep it readable for that time, then dispose of it in a controlled way.
| Lifecycle step | Clause 7.5 reference | What goes wrong without it |
|---|---|---|
| Identification and ownership | 7.5.2 a) | Nobody is accountable; files go missing |
| Format and storage | 7.5.2 b), 7.5.3 d) | Documents are hard to find or no longer readable |
| Review and approval | 7.5.2 c) | Unapproved or out-of-date versions are used |
| Access and distribution | 7.5.3 c) | Unauthorised edits or leaks |
| Change control | 7.5.3 e) | No history of what changed, so earlier versions cannot be shown or restored |
| Retention and disposal | 7.5.3 f) | Old documents stay in use or records are deleted too early |
One uncontrolled copy or missing approval can undo an otherwise well-run ISMS.
What does good document control look like in practice?
Well-controlled documented information means anyone with the right access can find the current version of a document, see who approved it and show its history without a search. In practice that usually comes down to:
- A single register of documents and records: one list of what exists, who owns it and where it lives.
- Logged retrieval: a record of who opened, changed or approved each item, and when.
- Full version history and backups: no “final_v2” copies saved under new names.
- Role-based access: edit rights limited to owners and approved delegates.
- Readable records for their whole life: kept in a format that can still be opened when needed, then disposed of on schedule.
- Retention periods mapped to obligations: set with your legal and contractual duties in mind.
What are the common weaknesses in documented information control?
Many gaps in an ISMS come from small lapses rather than technical failures: handover emails that never reach the register, reviews that slip, documents kept outside the system, or access rights that are never revisited.
Warning signs include:
- Old versions still available to everyday users
- No record of review or sign-off after an urgent update
- Copies downloaded and edited outside the managed system
- Records kept past their retention period, or lost before it ends
- Unclear ownership of important documents
Ways to close these gaps:
- Keep every document and record in one system built for the ISMS.
- Automate permissions, review reminders and versioning so nothing depends on memory.
- Assign an owner to every document and check that owners stay current when people move roles.
- Use internal audits (Clause 9.2) to test that documents can be found and are current.
- Make good record-keeping part of everyday work, not a task saved for audit week.
Why does documented information control matter beyond certification?
Controlled documented information is useful well beyond the certification audit. A customer doing due diligence may ask to see your information security policy, your Statement of Applicability or evidence of recent risk assessments. Your board may want to see the results of management reviews. When policies, approvals, corrective actions and decisions sit in one controlled place, answering these requests takes minutes rather than days.
The organisations that can show their evidence quickly are the ones whose documents are controlled every day, not just before an audit.
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
How can you check your documented information is ready?
A quick self-check: for each item in the table above, can you answer yes to these questions?
- Can you find the current, approved version in under a minute?
- Does it show a title, date, version and owner?
- Is there a record of who reviewed and approved it, and when?
- Can you show what changed between this version and the last one?
- Do only the right people have the right to change it?
- Do you know how long it will be kept and how it will be disposed of?
Any “no” points to the part of Clause 7.5.2 or 7.5.3 that needs work.
Why choose ISMS.online for Clause 7.5 documented information?
ISMS.online keeps your ISMS policies, procedures and records in one place, with owners, review reminders, approvals and version history held against each item. It helps you:
- Start from policy and procedure templates, which you adapt to your organisation
- Give each document a named owner, assign tasks and set review reminders
- Record approval sign-off and keep version history
- Set permissions that separate who can view from who can edit
- Link Annex A controls to the documents and evidence that support them
- See what is overdue through dashboards and notifications
The certificate itself comes from an accredited certification body; ISMS.online helps you prepare the documented information that body will review. To see how it works for your documents and records, book a demo.
Frequently Asked Questions
Can you manage ISO 27001 documented information in spreadsheets and shared drives?
Yes. Clause 7.5 does not require any particular tool, and it allows paper or electronic media. The difficulty is keeping control as the ISMS grows: with files in spreadsheets, shared drives and email, updates get lost, approvals are hard to prove and old versions stay in circulation. A dedicated platform can track changes, flag missing sign-off and keep the history in one place, but a well-run shared drive with clear rules can also meet the clause.
How do you link Annex A controls to their supporting documents and evidence?
Start from the Statement of Applicability, which lists the controls you have chosen. For each control, record the document that says how you do it (a policy or procedure) and the records that show you did it (logs, reports, sign-offs). Add the owner and the next review date. When a risk or business change affects a control, the linked documents are then easy to find and update.
Who should own ISO 27001 documents?
A common approach is to give each policy, procedure and register a named owner who knows the subject, for example the IT manager for access control or HR for training records. The owner keeps the document current, arranges reviews and approves changes. Without named owners, documents tend to drift out of date when people change roles.
How often should ISO 27001 documents be reviewed?
Clause 7.5 does not set a review frequency. Many organisations set a yearly review as a minimum and also review documents when something changes, such as a new system, a reorganisation, an incident or a change in risk. Recording the review date and approver on each document makes this easy to show.
Do documents from outside the organisation need to be controlled?
Yes, where the ISMS depends on them. Examples include supplier contracts, security reports from service providers and copies of laws or standards you rely on. Record where each one came from, which version you hold and who keeps it current.
Did Clause 7.5 change between ISO 27001:2013 and ISO 27001:2022?
Only in minor wording. The three sub-clauses (7.5.1, 7.5.2 and 7.5.3) and their requirements are the same in both editions. The 2022 edition refers to “this document” rather than “this International Standard”, and the note on access says access “can imply” a decision on view or edit rights. Documented information built for the 2013 edition can carry over, as long as it reflects any changes to your Annex A controls.
