ISMS Documentation Checklist
Short answer: ISO/IEC 27001:2022 requires a specific set of documented information across Clauses 4–10, plus records demonstrating that the ISMS operates as designed. The mandatory documents include the ISMS scope, information security policy, risk assessment and treatment methodology, risk register, Statement of Applicability, objectives, competence records, and results of monitoring, measurement, audits, and management reviews. This checklist organises every required and recommended document with its standard reference.
TL;DR: ISO 27001 auditors assess two things: documentation (what you say you do) and records (evidence that you actually do it). Missing mandatory documents causes nonconformities at Stage 1. Missing records causes nonconformities at Stage 2. This checklist covers both.
Key Takeaways - ISO 27001:2022 does not prescribe document formats — it specifies what information must be documented and retained. - The Statement of Applicability (SoA) is the most important single document in the ISMS — treat it as such. - Documents and records are distinct: documents describe processes; records are evidence those processes occurred. - Clause 7.5 governs all documented information: creation, updating, control, availability, and retention. - ISO 27001:2022 added new control areas (threat intelligence, cloud security, secure coding) that require updated or new policies and procedures.
On this page
- Documents vs records: the distinction that matters
- Mandatory documents by clause
- The Statement of Applicability in detail
- Recommended policies and procedures (Annex A)
- Document control requirements
- Common documentation mistakes
- Frequently asked questions
Documents vs records: the distinction that matters
ISO 27001 uses the term "documented information" to cover both documents and records. The distinction matters for how you manage them:
Documents describe how processes should work — policies, procedures, methodologies, scope statements, plans. They are version-controlled, reviewed periodically, and updated when processes change.
Records are evidence that processes happened as described — audit reports, risk register entries, management review minutes, training completion logs, nonconformity records, monitoring results. They must be retained, protected from tampering, and retrievable for audit.
Clause 7.5 of ISO 27001:2022 requires all documented information to be: available where needed, adequately protected, controlled for distribution and access, stored and preserved, and retained and disposed of according to a schedule. These documented-information requirements and the clause references used throughout this checklist are defined in the published standard (ISO/IEC 27001:2022, iso.org).
Mandatory documents by clause
The following documents are explicitly required by the standard. A certification auditor will expect to see each one.
Clause 4 — Context of the organisation
| Document | What it must contain | Standard reference |
|---|---|---|
| ISMS scope | Boundaries: organisational, geographic, technological; exclusions justified | Clause 4.3 |
| Context analysis | Internal/external issues, interested parties and their requirements | Clause 4.1, 4.2 |
Clause 5 — Leadership
| Document | What it must contain | Standard reference |
|---|---|---|
| Information security policy | Commitment to meet applicable requirements and to continual improvement; framework for setting objectives; approved by top management; communicated | Clause 5.2 |
| Roles and responsibilities documentation | ISMS owner, roles with information security responsibilities, reporting lines | Clause 5.3 |
Clause 6 — Planning
| Document | What it must contain | Standard reference |
|---|---|---|
| Risk assessment methodology | Criteria for risk acceptance; how risks are identified, analysed, and evaluated | Clause 6.1.2 |
| Risk register | Identified risks, asset/process owners, likelihood/impact ratings, risk level | Clause 6.1.2 |
| Risk treatment plan | Selected treatment option per risk, controls selected, responsible owner, timeline | Clause 6.1.3 |
| Statement of Applicability (SoA) | All Annex A controls listed; inclusion/exclusion status; justification; implementation status | Clause 6.1.3(d) |
| Information security objectives | Measurable objectives; plans to achieve them; responsibilities and timelines | Clause 6.2 |
Clause 7 — Support
| Document | What it must contain | Standard reference |
|---|---|---|
| Competence and training records | Required competencies; evidence of competence (qualifications, training completion) | Clause 7.2 |
| Awareness programme records | Topics covered; who received it; dates | Clause 7.3 |
| Communication plan | Internal and external communication; who, what, when, how | Clause 7.4 |
| Document control procedure | How documented information is created, reviewed, approved, distributed, and disposed | Clause 7.5 |
Clause 8 — Operation
| Document | What it must contain | Standard reference |
|---|---|---|
| Operational risk assessment records | Evidence that risk assessments are conducted at planned intervals and when significant changes occur | Clause 8.2 |
| Risk treatment implementation records | Evidence that treatment plan actions have been completed | Clause 8.3 |
Clause 9 — Performance evaluation
| Document | What it must contain | Standard reference |
|---|---|---|
| Monitoring and measurement results | What is measured, when, by whom, results over time | Clause 9.1 |
| Internal audit programme | Scope, frequency, methods, responsibilities | Clause 9.2.1 |
| Internal audit reports | Findings, evidence reviewed, nonconformities, auditor details | Clause 9.2.2 |
| Management review minutes | Inputs reviewed, decisions made, actions assigned, attendees | Clause 9.3 |
Clause 10 — Improvement
| Document | What it must contain | Standard reference |
|---|---|---|
| Nonconformity and corrective action register | Nonconformity description, root cause analysis, corrective action, verification of effectiveness | Clause 10.1 |
The Statement of Applicability in detail
The SoA is the pivot document of the ISMS. It bridges the risk assessment (which identifies risks) and the control implementation (which mitigates them). The inclusion justifications in the SoA should trace directly back to entries in your risk register and treatment plan; see ISO 27001 risk assessment and treatment explained for how the risk-to-control mapping is produced.
For each of the 93 Annex A controls, the SoA must state:
- Applicable or not applicable — and if not applicable, the justification.
- Implementation status — not started, partially implemented, or fully implemented.
- Justification for inclusion — linked to specific risks from the risk register, legal/contractual requirements, or organisational requirements.
The SoA is a living document. It must be reviewed and updated whenever the risk profile changes, new controls are implemented, or existing controls are modified.
Recommended policies and procedures (Annex A)
In addition to mandatory clause documents, the following policies and procedures support your Annex A control implementation. These are not individually mandated by name in the standard, but covering these areas is expected.
| Policy/Procedure | Relevant controls |
|---|---|
| Access control policy | A.5.15, A.5.16, A.5.17, A.5.18 |
| Asset management policy | A.5.9, A.5.10, A.5.11, A.5.12 |
| Cryptography policy | A.8.24 |
| Physical security policy | A.7.1–A.7.14 |
| Supplier security policy | A.5.19–A.5.22 |
| Incident management procedure | A.5.24, A.5.25, A.5.26, A.5.27 |
| Business continuity and ICT readiness plan | A.5.29, A.5.30 |
| Secure development policy | A.8.25–A.8.32 |
| Data classification and handling policy | A.5.12, A.5.13 |
| Clear desk and clear screen policy | A.7.7 |
| Remote working policy | A.6.7 |
| Acceptable use policy | A.5.10 |
| Data retention and disposal procedure | A.8.10 |
| Change management procedure | A.8.32 |
| Vulnerability management procedure | A.8.8 |
| Logging and monitoring procedure | A.8.15, A.8.16, A.8.17 |
| Cloud security policy | A.5.23 |
| Threat intelligence procedure | A.5.7 |
Document control requirements
Every document in your ISMS must be subject to Clause 7.5 controls:
- Version control: each document has a version number, revision date, and change history.
- Review schedule: documents must be reviewed at defined intervals (typically annually) or when significant changes occur.
- Approval: changes require documented approval by an authorised owner.
- Distribution control: staff have access to current versions; superseded versions are withdrawn.
- Retention: documents and records are retained for defined periods aligned with legal requirements and operational need.
A document management system — even a well-organised shared drive with a naming convention and index — can satisfy these requirements. You do not need specialised software, but you do need discipline.
Common documentation mistakes
Writing policies no one follows. An access control policy that says "all access requests must be approved by the system owner and documented" but where access is routinely granted via Slack messages without records is a Stage 2 nonconformity.
Treating the SoA as a formality. A SoA that marks all controls "applicable" and "implemented" without connecting them to specific risks will not survive audit scrutiny. Exclusions need justification; inclusions need evidence.
No document ownership. Every document needs a named owner responsible for keeping it current. Documents without owners become stale and fail version control checks.
Conflating templates with documented information. Downloading a policy template and placing it in a folder does not satisfy the requirement. The document must be reviewed, tailored to your context, approved, and communicated.
For the broader implementation context, see the ISO 27001:2022 implementation roadmap and the gap assessment guide.
Frequently asked questions
How many documents does ISO 27001 require?
The standard does not state a document count; it specifies the documented information that must be retained across Clauses 4–10 (ISO/IEC 27001:2022, iso.org). Mapping those requirements produces roughly 20–25 distinct mandatory documented items. In our experience building ISMS document sets for medium-sized organisations, the complete set typically runs to 40–60 documents and records once supporting policies, procedures, plans, and evidence records are included. Both figures are practitioner estimates, not standard-mandated counts, and will vary with scope.
Does ISO 27001 require specific document formats?
No. The standard specifies what information must be documented, not what format to use. Word documents, PDFs, wiki pages, and GRC tool entries all satisfy the requirement — as long as they are version-controlled, approved, and accessible.
Is the Statement of Applicability required even if I use all 93 controls?
Yes. The SoA is a mandatory document regardless of how many controls you apply. Even if you apply all 93, you must document the justification for each one and its implementation status. It also serves as the key reference document linking risk assessment outputs to control selection.
How often should ISMS documents be reviewed?
Most organisations set an annual review cycle. Documents must also be reviewed when significant changes occur — new systems, new products, organisational changes, or changes in the threat landscape. The review and approval must be recorded.
ThreatBlock's ISO 27001:2022 Readiness course includes document templates for every mandatory ISMS document, with guidance on tailoring each one to your organisation.
About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity compliance and risk management. Read more on the author page · Editorial policy.