ISO 9001 clause 7.5.3.1: make information usable and protected

What clause 7.5.3.1 requires in practice

Clause 7.5.3.1 sets two outcomes for the documented information that the quality management system and the standard require. The first is that it is available and suitable for use, in the place and at the time the user needs it. The second is that it is adequately protected, and the clause gives examples of what protection means: guarding against loss of confidentiality, against improper use and against loss of integrity.

Both outcomes must hold together. Information that is perfectly secure but cannot be reached by the people who need it fails the first outcome, and information that anyone can change fails the second. Suitability also covers fit, so a correct document that is unreadable on the device used at the workstation, or written for a different product, is not suitable. The clause does not say how to meet these outcomes. Access rules, passwords, physical filing, encryption and read-only copies are all possible methods, and the organisation chooses according to the nature and sensitivity of the information. Detailed lifecycle activities are covered in clause 7.5.3.2.

Examine the point of use

Identify who needs the information, for which decision and at what stage of work. Check whether users can obtain the appropriate content in practice. A file stored centrally may be technically available while remaining difficult to find, inaccessible from a project location or unsuitable for the device used at the task.

Suitability also concerns whether the information applies to the work. A current corporate instruction may need relevant project or customer information before it can support a particular decision. Avoid treating “latest version” as the only test when the real question is whether the content is appropriate for the situation.

Why availability and protection must go together

People under time pressure use whatever they can reach. If the official source is hard to find or cannot be opened on site, they will rely on copies, and mistakes follow. If the source is open to anyone, a well-meant edit can quietly alter an instruction or a customer's confidential details can reach the wrong person. Either failure damages trust with customers and can turn a routine job into an incident. Balanced arrangements keep teams productive while protecting what matters, and they give management confidence that decisions are based on reliable information. Auditors often test this by asking a user to open the current instruction, and then asking who else could change it.

How to implement clause 7.5.3.1

Start with how people use the information, not with the storage system. One way Sterling's teams do this is to shadow a user for a typical task and note how they obtain what they need.

1. List who needs each important item, for which decision or task, and at which point of the work.
2. Check that those users can reach the current content in practice, including at remote sites, on mobile devices and out of hours.
3. Confirm suitability: the information applies to the product, service or customer concerned and is understandable to the reader.
4. Check that users know where the authoritative copy sits and what to do if it cannot be reached when they need it.
5. Classify the information by sensitivity and decide what protection each class needs against disclosure, misuse and alteration.
6. Set permissions so that viewing and changing are separate rights given to the right roles.
7. Review reports of access problems or incidents, and adjust the balance between ease of use and protection as the work, tools and people change over time.

Illustrative construction example: information away from the office

Illustrative BPO example: access without uncontrolled alteration

A hypothetical BPO service keeps customer-specific processing instructions in a shared folder. All agents can edit the files because managers want everyone to correct mistakes quickly. An unauthorised wording change alters how an exception is handled, and different agents begin applying different interpretations.

The organisation distinguishes the access needed to use instructions from the authority needed to change them. It provides a clear route for suggesting corrections and ensures that approved information remains accessible. Evaluation examines whether agents can find the right instruction and whether changes follow the intended review. Restricting access so severely that agents use old personal copies would create a different control failure.

Choose protection that matches the information

Consider the consequences of disclosure, loss, unauthorised or inappropriate use, and alteration. Different information may need different protections. Customer data, acceptance evidence and a general process diagram may have distinct confidentiality and integrity needs even when all are part of the QMS.

The clause does not prescribe one security classification scheme, product or permission model. Suitable controls may involve technical settings, physical arrangements, role responsibilities and user practices. The organisation should understand how the selected approach protects the information while allowing legitimate work to proceed.

Check availability and protection together

When changing systems or access arrangements, consider effects on users and connected processes. A permission change may protect a record from editing while unintentionally preventing an authorised reviewer from seeing it. A new shared location may improve access while exposing information to people who do not need it.

Test representative situations, including retrieval of the correct information and the response to an access problem. These are practical evaluation methods, not a mandatory testing script. The extent of checking should reflect the importance of the information and the possible consequences of failure.

Evidence and common weaknesses