Free resource · ISO/IEC 27001:2022
ISO 27001 Mandatory Documents Checklist
ISO 27001:2022 asks for specific documented information, and auditors look for a few more policies in practice. This list shows which is which, so you write what is required and skip the rest. Download the CSV to track status.
Documents the standard requires
- Scope of the ISMS (clause 4.3)
- Information security policy (5.2)
- Risk assessment process and criteria (6.1.2)
- Risk treatment process (6.1.3)
- Statement of Applicability (6.1.3 d)
- Information security objectives and plans to achieve them (6.2)
Records the standard requires
- Evidence of competence of people doing security work (7.2)
- Results of the information security risk assessment (8.2)
- Results of the risk treatment, including the treatment plan and residual risk acceptance (6.1.3 e, f; 8.3)
- Evidence of monitoring and measurement results (9.1)
- Internal audit programme and audit results (9.2)
- Results of management reviews (9.3)
- Nature of nonconformities and any action taken, and results of corrective action (10.2)
Policies and records auditors usually expect
- Access control policy
- Acceptable use policy
- Cryptography and key management policy
- Backup policy and restore test records
- Incident response plan and incident log
- Supplier and third-party security policy, with supplier reviews
- Business continuity and ICT continuity plan, with test results
- Secure development and change management policy
- Asset inventory and information classification scheme
- Remote working and mobile device policy
Housekeeping for all documents
- Each document has an owner, version, date and approval
- Documents are reviewed on a schedule and after significant change
- Access to documents is controlled and the current version is easy to find
- Obsolete versions are retained only for a reason and marked as superseded
Based on ISO/IEC 27001:2022. Clause references show where the standard requires documented information; the third group is common audit practice, not a formal requirement. See iso.org.
ISO 27001 documents FAQ
- How many documents does ISO 27001 require?
- The standard names about 6 documents (such as the scope, policy, risk assessment and treatment processes, SoA and objectives) and about 7 kinds of records. Annex A adds policies and procedures you will need depending on which controls apply to you.
- Do we need a separate policy for every Annex A control?
- No. Write the policies your risks and the SoA call for, and keep them short. A policy for something you do not do, or a rule nobody follows, is a liability in an audit.
- What is the difference between a document and a record?
- A document says what should happen (a policy or procedure). A record proves what did happen (an audit report, an access review, a training log). Auditors test both.
- Did the 2022 revision change the required documents?
- The required documented information is essentially the same as in 2013. The main change is the new Annex A structure, which your Statement of Applicability must follow.
Write less, prove more
CATAAM generates the SoA and keeps controlled evidence for your policies and records, so your documents stay current without a document-control project.