How do we decide what documented information our ISMS needs and keep it under control?

Start

We must show our ISMS documents and records are controlled

Clause 7.5 asks for the documented information the standard requires and the information you decide the ISMS needs to be effective. It then asks that it is identified, approved, available, protected, retained and disposed of. The decision is how much to write down and how tightly to control it.

• Then: List what the standard requires and what you already hold

Step

List what the standard requires and what you already hold

The pack's checklist names 16 items of documented information the standard requires, by clause, and the documents and records auditors commonly expect for Annex A controls. Against each, write the document or record you already have, wherever it lives. Existing registers, tickets and tool exports often count.

• Then: Does a document or record already cover each required item?

Decision

Does a document or record already cover each required item?

One document can cover several items if it holds everything each one needs. The checklist accepts a combined policy or a tool export as a substitute, if it is approved and under control. If you have not checked every row, answer no.

• Yes: Would a process go wrong if its steps were not written down?
• No, or not known: Point to it, or write the shortest document that meets the test

Step

Point to it, or write the shortest document that meets the test

Name the existing document against each item. Where nothing exists, write the shortest document that passes the checklist's 'pass when' test. The pack says a small organisation can hold the scope, roles, risk method and objectives in one short ISMS manual, as long as each item is there, approved and used.

• Then: Would a process go wrong if its steps were not written down?

Decision

Would a process go wrong if its steps were not written down?

The standard lets you decide what else the ISMS needs in writing. A procedure earns its place where mistakes are costly, several people do the task, or a customer or regulator expects it. Writing procedures only to please an auditor produces shelfware. If you are unsure for a risky process, answer yes.

• Yes, or not known: Write a short procedure from how the work is really done
• No: For each document: give an ID, version, owner, approver, review date

Step

Write a short procedure from how the work is really done

Keep it to the steps, the roles and the records the process leaves, and link it to the policy that sets the rule. A procedure that describes work nobody does is a finding. Name its owner and put it in the same register as the other documents.

• Then: For each document: give an ID, version, owner, approver, review date

Step

For each document: give an ID, version, owner, approver, review date

Documents say how work is done and are revised. Records, covered next, show it happened and are kept as they were. Give each document an ID that never changes, major and minor versions, an approver who did not write it and a review date. Publish only the current approved version in one place, withdraw and archive old ones, and note its format and keep it readable.

• Then: For each record: decide where it is kept, who owns and may change it

Step

For each record: decide where it is kept, who owns and may change it

For each record type name the system, the owner, who can read it and who can alter it. A record that shows a control operated should not be editable by the people whose work it shows. Check that you can retrieve it for the period an auditor will sample. Keep each record readable for as long as it is retained.

• Then: Do you rely on documents from outside, such as a supplier report?

Decision

Do you rely on documents from outside, such as a supplier report?

Documented information of external origin that the ISMS needs, such as a provider's certificate, audit report or a customer's requirement, should be identified and controlled too (secondary sources on clause 7.5.3). The pack tells you to name a provider's document and where you hold your copy, and to ask for its records.

• Yes: List each with its date, where your copy is kept and who may see it
• No: Keep controlled documents in one place with access rules

Step

List each with its date, where your copy is kept and who may see it

Note the issuer, the period it covers, the date you received it and any terms on sharing. A report held in someone's inbox is not under control. Replace it when a new one arrives and keep the old one if the audit period needs it.

• Then: Keep controlled documents in one place with access rules

Step

Keep controlled documents in one place with access rules

Say where the current version lives, who may read it and who may change it. A shared folder with read-only rights can be the library for a small organisation. Printed or downloaded copies are uncontrolled, and the document should say so.

• Then: Does a law, a contract or an investigation need set a keep period?

Decision

Does a law, a contract or an investigation need set a keep period?

Retention and disposal are part of control. Some records must be kept for a period set by law or contract, and personal data must not be kept longer than its purpose needs. If you do not know, ask legal or compliance. The register of legal and contractual requirements is where such periods are found.

• Yes: Set the keep period from that duty and record where it comes from
• No, or not known: Choose a keep period yourself and write the reason

Step

Set the keep period from that duty and record where it comes from

Where several duties apply, take the longest that is lawful and write down the source. Name who deletes or archives at the end. The pack's records table shows the shape: the record, where it is held and the minimum retention. Its periods are placeholders for you to replace.

• Then: Are documents already past their review date?

Step

Choose a keep period yourself and write the reason

With no outside duty, keep each type as long as you need it to investigate, to show a control operated across the audit period and to meet your own review cycle. Write the reason down, name who disposes of it and review the period when your risks change.

• Then: Are documents already past their review date?

Decision

Are documents already past their review date?

A document that is in force but past its review date is a common finding. The pack keeps such a document in force while its review is pending, and escalates it. Expect an auditor to ask why the review is late. If you have not checked the register, answer yes.

• Yes, or not known: Review them in order of risk, then keep the dates
• No: Trace a sample: current, approved, in use and easy to find

Step

Review them in order of risk, then keep the dates

Start with the documents that rules and audits rest on: the policy, the risk method and the access, incident and backup standards. Record a review even when it changes nothing. The question on recovering overdue policies goes into more detail.

• Then: Trace a sample: current, approved, in use and easy to find

Step

Trace a sample: current, approved, in use and easy to find

Pick a few items from the checklist and test the four things it tests: it exists, it is approved where that applies, it is under control, and there is evidence of use. Ask a person who does the work to find the current version without help. The auditor will do the same.

• Then: Did the sample find a draft in use, a missing approval or an old copy?

Decision

Did the sample find a draft in use, a missing approval or an old copy?

Any one of these means control is not yet reliable. A draft that people follow, an approval nobody can show, are the kind of gap the checklist says auditors reliably find. A superseded copy still in circulation breaks the pack's one-published-copy rule. If you did not sample, answer yes.

• Yes, or not known: Fix them, withdraw the old copies, then sample again
• No: Documented information decided, controlled and sampled

Step

Fix them, withdraw the old copies, then sample again

Approve or withdraw the draft, find the missing approval or redo it, and remove old copies from every place they were put. Then take a fresh sample. Repeat until a sample passes.

• Then: Trace a sample: current, approved, in use and easy to find (back to an earlier step)

Outcome

Documented information decided, controlled and sampled

Keep the register and the result of the last sample. Do not say the ISMS is complete because every row of the checklist has an entry, or count documents as maturity. The standard asks that what you hold is approved, available, protected and used.