ISO 27001 clause 7.5.3: Controlling documented information
ISO 27001 clause 7.5.3 concerns documented information throughout its use. It must be available and suitable where needed and adequately protected. A policy can be correctly approved yet poorly controlled if employees cannot find it, unauthorised people can change it or obsolete versions remain in active use.
What clause 7.5.3 requires in practice
Clause 7.5.3 asks the organisation to control the documented information that the ISMS and the standard call for. The control has two aims: the information can be found and used when and where it is needed, and it is properly safeguarded against being disclosed, misused or corrupted. To achieve this, the organisation addresses the relevant activities from this list.
- Distribution, access, retrieval and use.
- Storage and preservation, including keeping material legible.
- Control of changes, such as version control.
- Retention and disposition.
Information of external origin that the organisation judges necessary for planning and operating the ISMS must also be identified and controlled. The note explains that access may mean viewing only, or viewing with authority to change. The outputs are information that people can find and rely on, and that the wrong people cannot read or alter. How this is done, whether through a document platform, folders or paper files, is left to the organisation.
Balance availability and protection
Determine who needs to view information and who may change it. These are different permissions. A broad audience may need an operating instruction, while only authorised owners should edit the approved source. Sensitive risk, incident or personnel evidence may need more restricted access than general policy information.
Consider how people retrieve and use information in real conditions. A record stored in a departed employee’s personal folder is not reliably available. An emergency instruction accessible only through the unavailable system it is meant to recover may also be unsuitable. Design access around the process and its foreseeable needs.
Control the information lifecycle
Address distribution, access, retrieval and use; storage and preservation; change control; and retention and disposition as applicable. Preserve legibility and the ability to interpret relevant evidence over time. A file can still exist while its proprietary format, missing context or unreadable scan makes it practically unusable.
Determine retention through applicable obligations, operational needs and the organisation’s decisions. ISO 27001 does not set one universal retention period for all records. Avoid keeping everything indefinitely by default or deleting evidence simply because storage is inconvenient. Coordinate decisions with relevant legal, contractual and privacy responsibilities.
Necessary external information also needs appropriate identification and control. This might include provider instructions, customer security requirements or an authoritative technical reference needed to operate a process. The aim is to use a suitable current source and recognise relevant changes, not to copy every external publication into an internal repository.
Why control of documented information matters to the business
The commercial value of documentation depends on trust in it. If a supplier questionnaire answer cites a procedure that has since been replaced, or a confidential risk assessment is readable by everyone, the organisation faces both operational and reputational harm. Good control also protects against practical losses such as a corrupted file or a lost laptop that held the sole copy. It simplifies audits, since staff can show the current version immediately. For regulated sectors, retention and disposal rules reduce legal exposure by keeping records as long as needed and no longer. Control is therefore part of how a business protects its own knowledge as well as its customers.
How to implement clause 7.5.3
Treat control as a set of everyday habits supported by a suitable tool. A reasonable approach follows. Where confidential records are involved, involve the people who own the underlying risk, because they best understand who should and should not see the material.
- Choose a single authoritative location for each type of information, and make it easy to reach for those who need it.
- Define who may read, who may edit and who may approve, using group-based access rather than individual favours.
- Apply version control, so superseded copies are clearly marked or withdrawn and printed copies are traced.
- Plan backup and preservation, including readable formats for long-lived records.
- Set retention periods and disposal methods that reflect legal, contractual and business needs, and apply them.
- Identify external documents you depend on, record their source and check for updates regularly.
- Test control from time to time by attempting access as an ordinary user and by retrieving a record from backup.
Illustrative examples
Account teams receive changed handling rules from a customer. The provider identifies the authoritative instruction, limits editing, communicates the update and removes obsolete operating copies. Retained historical evidence remains distinguishable from the current instruction, so an auditor can understand both what applies now and what applied at the time of a past transaction.
The company changes its delivery platform. Before migration it identifies approval and review records needed for its ISMS, verifies export integrity and checks that links to relevant releases remain understandable. Keeping a folder of unexplained screenshots would not provide the same traceability.
Evidence and practical tests
Sample an instruction from the point of work, then trace it to the approved source. Check who can edit it and whether older versions are distinguishable. Select a retained record and test retrieval by someone other than its original author. Review how external information changes are identified and acted on.
Permissions, revision history, controlled repositories and retention arrangements can support the evidence, but no particular document-management product is mandatory. Evaluate the actual control. A platform with sophisticated features does not help if permissions are broadly misconfigured or staff maintain uncontrolled alternatives.
Common mistakes
Do not treat a shared folder as automatically controlled, use personal inboxes as the only evidence store or distribute sensitive full reports where a controlled summary would meet the need. Another common weakness is deleting or overwriting evidence during process changes without considering retention.
Connect these controls to review and approval, protection of records and information classification. The result should be reliable information that supports work and accountability rather than an archive that only its administrator understands.
Frequently asked questions
Does ISO 27001 specify how many years every record must be kept?
No single universal period is prescribed. Determine appropriate retention using applicable obligations, business needs and the relevant requirements for evidence.
Can staff have read access without edit access?
Yes. Viewing and changing information are different authorities. Set access according to role and need while keeping information usable for its intended purpose.
Do external documents need control too?
Necessary external information should be appropriately identified and controlled. Decide how staff find the authoritative source and how relevant changes are recognised.
Keep current information available and protected
Talk to Sterling to review document access, version changes, retention and disposition, including the external references your processes depend on. Build the relevant knowledge through Documented Information Management at Sterling Academy. We can also assess whether Effivity ISO & GRC automation software suits the agreed workflow and programme. Certification decisions remain with an independent certification body.