DOCUMENT ISO 27001

Minimum set of documents required by the ISO/IEC 27001 2022 revision.

Usually
ISO 27001
No What must be documented documented
reference
through
1 Scope of the ISMS Clause 4.3 ISMS Scope document
2 Information security policy Clause 5.2 Information
Security Policy
3 Risk assessment and risk Clause 6.1.2 Risk Assessment and
treatment process Treatment Methodology
4 Statement of Applicability Clause 6.1.3 d) Statement of
Applicability
5 Risk treatment plan Clause g 6.1.3 e, Risk Treatment Plan
6.2, and 8.3
6 Information security objectives Clause 6.2 List of Security
Objectives
7 Risk assessment and treatment Clauses 8.2 and Risk Assessment &
report 8.3 Treatment Report
8 Inventory of assets Control A.5.9* Inventory of Assets, or List
of Assets in the Risk
Register
9 Acceptable use of assets Control A.5.10* IT Security Policy
10 Incident response procedure Control A.5.26* Incident Management
Procedure
11 Statutory, regulatory, and Control A.5.31* List of Legal, Regulatory,
requirements contractual and Contractual
Requirements
12 Security operating procedures Control A.5.37* Security Procedures for IT
for IT management Department
13 Definition of security roles and Controls A.6.2. Agreements, NDAs, and
responsibilities and A.6.6* specifying responsibilities in
each security policy and
procedure
14 Definition of security Control A.8.9* Security Procedures for IT
configurations Department
15 Secure system engineering Control A.8.27* Secure
principles Development Policy
*Note: ISO 27001 documents and records required by Annex A controls are mandatory only if there are risks or
requirements from interested parties that would demand implementing those controls.
 RECORD ISO 27001
Minimum set of records required by the ISO/IEC 27001 2022 revision.

Usually
ISO 27001
No What must be recorded documented
reference
through
1 Training, skills, experience, and Clause 7.2 Training certificates and CVs
qualifications
2 Monitoring and measurement Clause 9.1 Measurement Report
results
3 Internal audit program Clause 9.2 Internal Audit Program
4 Results of internal audits Clause 9.2 Internal Audit Report
5 Results of the management Clause 9.3 Management Review
review Minutes
6 Results of corrective actions Clause 10.2 Corrective Action Form
7 Logs of user activities, Control A.8.15* Automatic logs in
exceptions, and security events information systems
*Controls from Annex A can be excluded if an organization concludes there are no risks or other requirements
which would demand the implementation of a control.