Which documents does the standard name?
| Document | Why it exists |
|---|---|
| ISMS scope statement | Defines what the system covers; the boundary every other decision references |
| Information security policy | Leadership's direction, approved by top management and communicated |
| Risk methodology, assessment and treatment plan | How risk is judged, what you found, what you decided to do about it |
| Statement of Applicability | Your justified position on all 93 Annex A controls; see my SoA guide |
| Information security objectives | What you are trying to achieve, measurably, and how it is going |
Which records must you keep?
- Evidence of competence: training, qualifications, experience for roles affecting security
- Monitoring and measurement results against your objectives
- Internal audit programme, plans and reports: see my internal audit guide
- Management review minutes with inputs, decisions and actions: see my management review guide
- Nonconformities and corrective actions, with evidence the actions worked
- Operating records your controls generate: asset inventory, access reviews, supplier assessments, incident log, backup restore tests, change records
My ISO 27001 checklist places every item above in the order you will create it, alongside the clause requirements.
How large should your policy set be?
Beyond the main policy, write topic policies where a reader needs rules at the point of work: acceptable use, access control, suppliers, incidents, backup and recovery, remote working where it applies. Each should be short, owned, approved, versioned, and reviewed at planned intervals or after significant change.
The test an auditor applies is whether staff can find the current version and whether practice matches it. Matching practice sometimes means rewriting the policy to describe what you sensibly do.
How do you control documents without bureaucracy?
- Every controlled document: title, owner, version, approval, review date.
- One place of truth; uncontrolled copies removed or clearly marked.
- Changes communicated to the people the document affects.
- Review triggered by change and incident, not only by the calendar.
This is deliberately paraphrased guidance. For the authoritative wording, obtain the standard itself from BSI or ISO: any source reproducing its text verbatim should be treated with suspicion.