ISO 27001 clause 7.5.2: Creating and updating ISMS information
ISO 27001 clause 7.5.2 addresses the quality of documented information when it is created or updated. Ensure appropriate identification and description, suitable format and media, and review and approval for suitability and adequacy. Both review and approval matter; they are not interchangeable alternatives.
What clause 7.5.2 requires in practice
Clause 7.5.2 deals with the moment documented information is made or changed. Three things must be appropriate whenever this happens.
- Identification and description, for example a title, date, author or reference number, so a reader knows what the item is and which version it is.
- Format and media, covering things such as language, software version and graphics, and whether it is on paper or held electronically.
- Review and approval for suitability and adequacy, meaning someone with proper authority checks that the content is fit for its purpose.
The examples in brackets are illustrations, not a prescribed header layout. What counts is that readers can identify the item, use it in the form that suits them, and trust it because it has been checked. The outputs are consistent, recognisable information whose status is clear. The clause covers every item that falls within 7.5.1, whether a policy, a record or a process description, though the depth of review may reasonably vary with the importance of the item.
Make the information identifiable and usable
People need to understand what an item is, what it applies to and whether they have the appropriate version. Identification can use meaningful titles, references, dates or other appropriate information. The standard gives flexibility; it does not require every organisation to adopt the same document-code structure.
Choose a format that works for the user and the task. A multilingual workforce, a project site with limited connectivity or a process using structured digital records may need different arrangements. A beautifully formatted procedure is unsuitable if it cannot be accessed or understood where the work is performed.
Why creating and updating information matters to the business
Information that nobody can date, attribute or trace to an approver is hard to rely on. In a dispute with a customer, in an incident review or in an audit, the first question about any record is whether it is current and authorised. Consistent identification also makes it possible to see what changed and when, which supports investigation and learning. Choosing formats that suit readers, such as short guidance for shift staff, keeps procedures used rather than ignored. Approval by the right person prevents well-meant but unsuitable instructions from spreading, and shows customers that the organisation's commitments have owners.
How to implement clause 7.5.2
The goal is a light but reliable routine for every new or changed item. A simple approach is described below. Keep the routine light enough that staff will actually follow it for small updates, not only for major policy documents.
- Decide the minimum identifiers every item carries, such as title, owner, date and version, and apply them consistently.
- Choose formats and media to suit the readers, considering language, device and working environment.
- Name an author and a reviewer for each type of information, with approval resting on someone qualified to judge its adequacy.
- Define what review involves for different levels of importance, so low-risk items are not slowed by heavy sign-off.
- Make the review visible, whether through a workflow, a signature or a logged comment, so approval can be shown later.
- Check older items for the same identifiers and bring the important ones into line over time.
- Sample new items occasionally to confirm that the routine is followed.
Illustrative examples
An infrastructure change makes parts of the old instruction inaccurate. Technical staff test the revised steps, the service owner reviews whether the result meets the operating need and the authorised owner approves release. Version identity and the effective instruction are clear, so an incident team does not use an earlier draft.
A project team needs concise guidance on sharing controlled design files. Review checks that links and screens work on the devices used at site, while approval confirms the process fits the project’s information responsibilities. A long desktop-only PDF would not be an adequate format simply because its wording is accurate.
Evidence and practical checks
Approval history, review comments, workflow records or other appropriate information can demonstrate the arrangement. Check a recent update: who reviewed it, what was considered, who approved it and how the current status is identified? Do not manufacture evidence after the fact to make an uncontrolled release appear approved.
Clause 7.5.2 applies to creating and updating documented information; clause 7.5.3 addresses control during distribution, use, storage and retention. A proper approval does not by itself ensure that obsolete copies are withdrawn or sensitive material is protected.
Common mistakes
Watch for approval by someone who has no relevant authority, technical review skipped for “minor” changes with significant consequences, and version numbers that do not identify which content was actually approved. Another problem is updating a shared page without a suitable review route because it does not look like a traditional document.
Keep the process proportionate. An inflexible approval chain for every low-impact correction can encourage informal workarounds. Define sensible arrangements while preserving review and approval for suitability and adequacy. The result should be dependable information that people can use confidently.
Frequently asked questions
Is review or approval enough on its own?
The clause requires appropriate review and approval. They can be implemented proportionately, but wording them as alternatives would miss part of the requirement.
Can we approve documents electronically?
Yes. Use a suitable arrangement that identifies the approved information and appropriate authority. ISO 27001 does not prescribe a wet-signature format.
Do controlled web pages and workflow instructions count?
They can be documented information. Apply suitable identification, format, review and approval rather than limiting the process to traditional office documents.
Create information people can identify and trust
Talk to Sterling to improve document identification, format, review and approval so users receive suitable instructions and records from the outset. Build the relevant knowledge through Documented Information Management at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.