ISO 27001 is the world’s leading information security standard, providing control requirements to create an Information Security Management System (ISMS). An ISMS is a systematic approach to managing information security risks and ensuring that information assets’ confidentiality, integrity, and availability are protected. ISO 27001:2022 is a moderate update from the previous version of the standard: ISO 27001:2013. 🌐
One of the key requirements of ISO 27001 is to document evidence of compliance with its clauses and controls. In this article, we will explain what each category of documents or records according to ISO 27001:2022.
Scope of the ISMS 🎯
The scope of the ISMS defines the boundaries and applicability of the information security management system within the organisation. The scope of the ISMS should be documented according to Clause 4.3 of ISO 27001:2022.
Elements of Scope documentation:
- Purpose and objectives of the ISMS
- Criteria for defining the scope
- Boundaries of the ISMS
- Exclusions or limitations of the ISMS and their justifications
- References to relevant documents or records that support the scope definition
Information Security Policy and Objectives 🔐
The information security policy and objectives express the leadership commitment and direction for information security within the organisation. They should be documented according to Clauses 5.2 and 6.2 of ISO 27001:2022.
Elements of Information Security Policy and Objectives documentation:
- Purpose, scope, and context of the information security policy and objectives
- Alignment of the information security policy and objectives with the strategic direction and business objectives of the organisation
- Criteria and methods for measuring, monitoring, analysing, and evaluating the achievement of the information security objectives
- Roles, responsibilities, and authorities for establishing, implementing, maintaining, and improving the information security policy and objectives
- Review and update process for ensuring the continual suitability, adequacy, and effectiveness of the information security policy and objectives
Risk Assessment and Risk Treatment Process ⚖️
The risk assessment and risk treatment process is the core of ISO 27001:2022. The process should be documented according to Clause 6.1.2 of ISO 27001:2022.
Elements of Risk Assessment and Risk Treatment Process documentation:
- Purpose, scope, and context of the risk assessment and risk treatment process
- Criteria and methods for identifying, analysing, evaluating, treating, monitoring, reviewing, and communicating information security risks
- Roles, responsibilities, and authorities for performing and overseeing the risk assessment and risk treatment process
- Sources of information and data used for the risk assessment and risk treatment process
- Outputs and outcomes of the risk assessment and risk treatment process
Statement of Applicability 📋
The Statement of Applicability (SoA) is a summary document that shows the selection and justification of information security controls from Annex A of ISO 27001:2022. The SoA should be documented according to Clause 6.1.3 d) of ISO 27001:2022.
Elements of Statement of Applicability documentation:
- Purpose, scope, and context of the Statement of Applicability
- Reference to the risk assessment and risk treatment process that determined the selection of controls
- List of all Annex A controls with their status, implementation level, and justification
- Review and update process for ensuring the continual suitability, adequacy, and effectiveness of the Statement of Applicability
Risk Treatment Plan 📝
The risk treatment plan is a document that outlines the actions, resources, responsibilities, timelines, and expected outcomes for implementing information security controls. The risk treatment plan should be documented according to Clauses 6.1.3 e), 6.2, and 8.3 of ISO 27001:2022.
Elements of Risk Treatment Plan documentation:
- Purpose, scope, and context of the risk treatment plan
- Reference to the risk assessment and risk treatment process that determined the selection of controls
- List of all controls with their description, implementation status, priority, owner, deadline, cost, benefit, and performance indicator
- Dependencies, assumptions, constraints, and risks related to the implementation of controls
- Review and update process for ensuring the continual suitability, adequacy, and effectiveness of the risk treatment plan
Risk Assessment and Treatment Report 📊
The risk assessment and treatment report is a document that documents the results and outcomes of the risk assessment and risk treatment process. It should be documented according to Clauses 8.2 and 8.3 of ISO 27001:2022.
Elements of Risk Assessment and Treatment Report documentation:
- Purpose, scope, and context of the risk assessment and treatment report
- Reference to the risk assessment and risk treatment process that generated the report
- Summary of the risk assessment and risk treatment process, including the methodology, criteria, sources, roles, responsibilities, and authorities
- List of all identified risks with their likelihood, impact, level, cause, consequence, owner, status, and reference to related documents or records
- List of all selected controls with their description, implementation status, priority, owner, deadline, cost, benefit, performance indicator, and reference to related documents or records
- List of all residual risks with their likelihood, impact, level, cause, consequence, owner, status, and reference to related documents or records
- Analysis of the effectiveness and efficiency of the risk assessment and risk treatment process
- Recommendations for improvement of the risk assessment and risk treatment process
Information Security Objectives 🎯
Information security objectives are measurable goals that reflect the desired outcomes of an information security management system. They should be documented according to Clause 6.2 of ISO 27001:2022.
Elements of Information Security Objectives documentation:
- Purpose, scope, and context of the information security objectives
- Criteria and methods for measuring, monitoring, analysing, and evaluating the achievement of the information security objectives
- Roles, responsibilities, and authorities for establishing, implementing, maintaining, and improving the information security objectives
- Review and update process for ensuring the continual suitability, adequacy, and effectiveness of the information security objectives
Other Mandatory Documents or Records 📚
Besides the documents or records mentioned above, ISO 27001:2022 also requires some other documents or records related to specific Annex A controls or other clauses of the standard.
Examples of other mandatory documents or records:
- Inventory of assets (Control A.5.9)
- Acceptable use of assets (Control A.5.10)
- Incident response procedure (Control A.5.26)
- Statutory, regulatory, and contractual requirements (Control A.5.31)
- Security operating procedures for IT management (Control A.5.37)
- Definition of security roles and responsibilities (Controls A.5.2 and A.5.24)
- Definition of security configurations (Control A.8.9)
- Secure system engineering principles (Control A.8.27)
- Records of user access provisioning (Control A.5.18)
- Records of user access reviews (Control A.5.18)
- Records of user access revocation (Control A.5.18)
- Records of cryptographic keys (Control A.8.24)
- Backup policy (Control A.8.13)
- Records of backup testing (Control A.8.13)
- Records of security events (Control A.6.8)
- Records of security incidents (Control A.5.24)
- Business continuity policy (Control A.5.29)
- Business impact analysis (Control A.5.29)
- Business continuity plan (Control A.5.29)
- Records of business continuity testing (Control A.5.29)
- Compliance evaluation procedure (Clause 9, A.5.36)
- Records of compliance evaluation results (Clause 9, A.5.36)
The above article explains the mandatory documents or records for ISO 27001:2022 compliance and how to document them. Documenting evidence for ISO 27001 compliance is essential to demonstrate the implementation and operation of the information security management system and to ensure its continual improvement. It is also a requirement for achieving and maintaining ISO 27001 certification.
Tips or Best Practices for Managing Documents or Records 📝
Here are some tips or best practices for creating, maintaining, updating, reviewing, storing, protecting, or disposing of documents or records:
- Use templates or tools to simplify and standardise the documentation process
- Assign clear roles and responsibilities for document or record owners, authors, reviewers, approvers, and users
- Establish a document or record control procedure to ensure consistency, accuracy, completeness, relevance, and timeliness of documents or records
- Use a document or record management system to store, organise, access, protect, and dispose of documents or records
- Review and update documents or records regularly or when changes occur in the organisation or its ISMS
- Dispose of documents or records securely when they are no longer needed or required
By following these best practices and ensuring that all mandatory documents and records are documented as per the ISO 27001:2022 standard, your organisation will be well-prepared to achieve and maintain ISO 27001 certification. This will not only demonstrate your commitment to information security but will also help you continuously improve your ISMS to meet the ever-changing security landscape.