Control 7.5.2Creating and updating
When creating and updating documented information, ensure appropriate identification and description — title, date, author, reference number — appropriate format and media, and appropriate review and approval for suitability and adequacy.
Housekeeping, and it earns its place. Without identification you cannot tell which version somebody followed; without review and approval you cannot tell whether anybody with authority agreed to it.
The requirement that is genuinely substantive is approval for suitability and adequacy — not merely that someone signed, but that someone competent judged the document fit for its purpose. A procedure approved by the person who wrote it, with no independent judgement of whether it is adequate, meets the form of the clause and not its substance.
In practice this clause is where an ISMS’s document set either becomes navigable or becomes an archive in which three versions of the same policy circulate and the current one cannot be identified.
How to put this in place
Documents need to be identifiable, approved and in a usable form from the start. Drafts in use and anonymous files undermine trust in the whole set.
- Set a standard for identification: title, ID, version, date, owner and classification.
- Use templates and a review and approval route.
- Define who approves each type of document.
- Record approvals and dates.
- Set review dates and chase them.
Evidence an auditor usually looks for: documents carrying identification, approval records and review dates, created from consistent templates.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
The checklist's four checks, including whether each document is under document control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.