Control 7.5.1General

The ISMS must include the documented information required by the standard, and the documented information the organisation determines is necessary for its effectiveness. The extent of it differs between organisations according to size, activities, processes, products and services, the complexity of processes and their interactions, and the competence of people.

The second half is the permission most organisations fail to use. The standard requires specific documents — the scope, the policy, the risk assessment and treatment results, the Statement of Applicability, competence evidence, monitoring results, audit programme and results, management review results, nonconformity records. Beyond those, what is necessary is the organisation’s judgement, and the explicit reference to the competence of people means a team that knows its work well needs less written down, not more.

The failure is uniform and self-inflicted: documentation produced for an auditor rather than for the people doing the work, which nobody uses and which therefore drifts out of date between audits.

How to put this in place

The ISMS needs the documents that make it work, no more. A project that writes a large policy set before choosing controls creates documents nobody runs.

List the documents and records the standard requires, using a checklist of required documents such as the CISO Times Mandatory ISMS Documentation Checklist, or your own list.
Add only the documents your chosen controls and processes need.
Create a register with owner, version and review date.
Mark records, which are kept, apart from documents, which are approved.
Check that every procedure the policies mention exists.

Evidence an auditor usually looks for: a document register, the completed list of required documents and records, and approved documents within their review dates.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-09: the typical form, what auditors accept instead and the gaps they reliably find.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.