Documents and Records Required for an ISO/IEC 27001 Management System

Here is a list of the ISO/IEC 27001 mandatory documents and records, as well as commonly used non-mandatory documents.

Mandatory Documents Required
by ISO/IEC 27001:2022

Here are the documents you need to produce if you want to be compliant with ISO/IEC 27001:

• Scope of the ISMS (Clause 4.3)
• Information security policy and objectives (Clauses 5.2 and 6.2)
• Risk assessment and risk treatment methodology (Clause 6.1.2)
• Statement of Applicability (Clause 6.1.3 d)
• Risk treatment plan (Clauses 6.1.3 e, 6.2, and 8.3)
• Risk assessment report (Clauses 8.2 and 8.3)

Annex A Documents (mandatory only if there are risks which would require their implementation):

• Definition of security roles and responsibilities (Clauses A.7.1.2 and A.13.2.4)
• Inventory of assets (Clause A.8.1.1)
• Acceptable use of assets (Clause A.8.1.3)
• Access control policy (Clause A.9.1.1) 
• Operating procedures for IT management (Clause A.12.1.1)
• Secure system engineering principles (Clause A.14.2.5)
• Supplier security policy (Clause A.15.1.1)
• Incident management procedure (Clause A.16.1.5)
• Business continuity procedures (Clause A.17.1.2)
• Statutory, regulatory, and contractual requirements (Clause A.18.1.1)

Mandatory Records Required
by ISO/IEC 27001:2022

• Records of training, skills, experience and qualifications (Clause 7.2)
• Monitoring and measurement results (Clause 9.1)
• Internal audit program (Clause 9.2)
• Results of internal audits (Clause 9.2)
• Results of the management review (Clause 9.3)
• Results of corrective actions (Clause 10.1)

Annex A Records

• Logs of user activities, exceptions, and security events (Clauses A.12.4.1 and A.12.4.3)

Non-Mandatory ISO/IEC 27001 Documents (but commonly used)

• Procedure for document control (Clause 7.5)
• Controls for managing records (Clause 7.5)
• Procedure for internal audit (Clause 9.2)
• Procedure for corrective action (Clause 10.1)
• Bring your own device (BYOD) policy (Clause A6.2.1)
• Mobile device and teleworking policy (Clause A6.2.1)
• Information classification policy (Clause A8.2)
• User Access Rights Policies including Password control (Clause A9.2)
• Disposal and destruction policy (Clause A.8.3.2 and Clause A.11.2.7)
• Procedures for working in secure areas (Clause A.11.1.5)
• Clear desk and clear screen policy (Clause A.11.2.9)
• Organizational Change management policy (Clause A.12.1.2)
• Software Change management policy (Clause A.14.2.4)
• Backup policy (Clause A.12.3.1)
• Information transfer policy (Clause A.13.2)
• Business impact analysis (Clause A.17.1.1)
• ISMS Continuity controls testing plan (Clause A.17.1.3)