---
title: "ISO 27001 Mandatory Documents: The Complete List"
description: "Every document and record ISO/IEC 27001:2022 explicitly requires, which policies you actually need, and how big your document set should be at your size."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-mandatory-documents
updated: 2026-11-10
---

# ISO 27001 mandatory documents: less paperwork than you fear

The standard explicitly requires a defined core: scope, policy, risk process and results, Statement of Applicability, objectives, audit and review records, and corrective action records. Beyond that core, each further document should earn its place through your risks.

## Which documents does the standard name?

| Document                                        | Why it exists                                                                                                 |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| ISMS scope statement                            | Defines what the system covers; the boundary every other decision references                                  |
| Information security policy                     | Leadership's direction, approved by top management and communicated                                           |
| Risk methodology, assessment and treatment plan | How risk is judged, what you found, what you decided to do about it                                           |
| Statement of Applicability                      | Your justified position on all 93 Annex A controls; see my [SoA guide](/resources/statement-of-applicability) |
| Information security objectives                 | What you are trying to achieve, measurably, and how it is going                                               |

## Which records must you keep?

- Evidence of competence: training, qualifications, experience for roles affecting security
- Monitoring and measurement results against your objectives
- Internal audit programme, plans and reports: see my [internal audit guide](/resources/iso-27001-internal-audit)
- Management review minutes with inputs, decisions and actions: see my [management review guide](/resources/iso-27001-management-review)
- Nonconformities and corrective actions, with evidence the actions worked
- Operating records your controls generate: asset inventory, access reviews, supplier assessments, incident log, backup restore tests, change records

My [ISO 27001 checklist](/resources/iso-27001-checklist) places every item above in the order you will create it, alongside the clause requirements.

## How large should your policy set be?

Beyond the main policy, write topic policies where a reader needs rules at the point of work: acceptable use, access control, suppliers, incidents, backup and recovery, remote working where it applies. Each should be short, owned, approved, versioned, and reviewed at planned intervals or after significant change.

The test an auditor applies is whether staff can find the current version and whether practice matches it. Matching practice sometimes means rewriting the policy to describe what you sensibly do.

## How do you control documents without bureaucracy?

- Every controlled document: title, owner, version, approval, review date.
- One place of truth; uncontrolled copies removed or clearly marked.
- Changes communicated to the people the document affects.
- Review triggered by change and incident, not only by the calendar.

This is deliberately paraphrased guidance. For the authoritative wording, obtain the standard itself from BSI or ISO: any source reproducing its text verbatim should be treated with suspicion.

## Frequently asked questions about ISO 27001 mandatory documents

### How many policies do you need for ISO 27001?

Fewer than most toolkits suggest: the standard requires an information security policy approved by top management, plus documented information wherever the standard or your own planning demands it. In practice most organisations operate one main policy and a small set of topic policies (access control, acceptable use, supplier security, incident management, backup) sized to their risks, because twenty downloaded policies nobody follows fail faster than six that match practice.

### What documents does ISO 27001 explicitly require?

The ISMS scope; the information security policy; the risk assessment and treatment methodology and results; the Statement of Applicability; information security objectives; evidence of competence; monitoring and measurement results; the internal audit programme and its results; management review records; and nonconformity and corrective action records. My checklist lists them in implementation order.

### Do documents need to follow a particular format?

No particular format is prescribed: the standard requires documented information to be identified, reviewed, approved, version-controlled and available where needed. A controlled wiki or document system satisfies this as readily as a policy library, provided approval and version history are genuine.

## Contact

Policy library grown faster than the business? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.