ISO 27001 Documented Information: Control What People Use

What clause 7.5 requires in practice

Clause 7.5 covers documented information, meaning the information the organisation must keep and maintain as part of the ISMS. It has three layers, each dealt with in its own subclause. First, the ISMS includes the documented information the standard itself calls for, plus whatever else the organisation judges necessary for the system to be effective. Second, when such information is created or updated, it needs suitable identification, format and media, and review and approval. Third, it must be controlled so that it is available and usable where and when needed, and protected from loss of confidentiality, misuse or loss of integrity.

The amount of documentation is expected to differ between organisations, depending on size, complexity and people's competence. The clause therefore does not set page counts or list mandatory manuals. Outputs are a set of information that is findable, current and trustworthy, plus the habits that keep it so. Documents of external origin that the ISMS depends on also need to be identified and controlled.

7.5.1: determine what information the system needs

Start with information explicitly required by the standard, then consider what is necessary for effective operation in your organisation. The extent can vary with size, complexity, activities and competence. A stable small team and a geographically distributed provider may need different levels of operating detail.

A practical test is to ask what happens when the usual expert is absent. If another competent employee cannot identify the approved decision, current configuration instruction or required evidence, the information arrangements may be too dependent on personal memory. This is a suggested usability test, not an additional ISO-mandated document.

7.5.2: identify, format, review and approve information

When creating or updating documented information, the organisation addresses appropriate identification and description, format and media, and review and approval for suitability and adequacy. A document's title and version are useful only when people can connect them with the right task and service.

For a hypothetical IT support provider, recovery instructions are maintained in a shared knowledge system. A specialist changes a critical step after a platform migration. The provider needs an arrangement for reviewing that change and ensuring the approved instruction is identifiable. Merely editing a page does not demonstrate that the changed instruction is suitable for recovery.

Approval methods can vary. The organisation should be able to show that its chosen method gives a clear, dependable decision, rather than assuming that every item requires a handwritten signature or an elaborate committee.

7.5.3: protect access, use and the information lifecycle

Documented information must be available and suitable where needed, and adequately protected. Control addresses distribution, access, retrieval and use; storage and preservation, including readability; changes; and retention and disposal, as applicable. Relevant externally originated information also needs identification and control. Access considerations include whether someone can only view information or can change it.

Protection includes confidentiality, integrity and availability. A highly restricted incident procedure that the authorised response team cannot reach during an outage is poorly suited to its purpose. Conversely, broad access to sensitive investigation records can expose information without a legitimate operational need.

Why documented information matters to the business

Documented information is how an organisation proves that security happens consistently rather than by memory. When it is poorly controlled, staff follow outdated procedures, sensitive material reaches the wrong readers and nobody can show a customer or auditor what was agreed. When it is excessive, people stop reading it and the system drifts from reality. Getting the balance right saves time in every audit and onboarding exercise, makes decisions traceable and protects confidential records, such as risk assessments, which are themselves sensitive. A lean, trusted set of information also lowers the cost of keeping the ISMS up to date as the business changes.

How to implement clause 7.5

Aim for the least documentation that gives confidence, then control it properly. A workable sequence follows. Resist the urge to write everything at once; a small controlled set that people trust is worth more than a large library that nobody maintains.

1. Identify the information the standard itself calls for, then add only what your own processes need to work reliably.
2. Decide how items are titled, dated, owned and referenced, so that any reader can tell what version they have.
3. Define who reviews and approves each type of information, matching the approver to the subject.
4. Choose where information is kept and who may read or change it, protecting confidentiality and integrity.
5. Set rules for version changes, retention and disposal, including the treatment of superseded copies.
6. Identify external documents you depend on, such as customer requirements or regulations, and keep their current versions.
7. Test the arrangements by asking a few staff to find the current version of a procedure and report what they used.

Evidence an auditor expects for clause 7.5

Auditors check that documented information is real, current and in use. They typically observe and sample rather than read everything.

• Records showing how items are identified, reviewed and approved, sampled across several areas.
• Observation of where staff actually obtain procedures, and whether those copies are the current ones.
• Access arrangements showing who can read and who can alter sensitive items.
• Records of changes and retention decisions, including disposal.
• Evidence that external documents relied on are identified and kept up to date.
• Interviews with staff about how they find and use information.

Common nonconformities with clause 7.5

Findings under this clause usually arise from control that exists on paper but not in practice.

• Outdated procedure copies are in use in a department because older versions remain accessible.
• Approval of documents cannot be shown, or was given by someone with no authority over the subject.
• Sensitive records, such as risk assessments, sit in open folders any employee can edit.
• Records have no retention or disposal decision, so obsolete material accumulates.
• Customer or regulatory documents the ISMS relies on are not identified or have been superseded.

Example: production support instructions at a manufacturer

Records need credible history

Records provide evidence of results and activities. Correcting an error in a record should not destroy the ability to understand what happened. Choose controls appropriate to the record's purpose, sensitivity and applicable requirements. ISO 27001 does not impose one universal retention period for all ISMS records.

An auditor may examine whether the instruction used during a sampled activity was current, whether an approval can be traced and whether results are retrievable. Useful evidence may include version history, review decisions and access arrangements. A platform's capabilities matter only when the organisation has configured and used them appropriately.

Explore each numbered part