Control 7.5.3Control of documented information

Documented information required by the ISMS must be controlled so that it is available and suitable for use where and when needed, and adequately protected — from loss of confidentiality, improper use, or loss of integrity. The organisation must address distribution, access, retrieval and use; storage and preservation including legibility; control of changes such as version control; retention and disposition. Documented information of external origin determined to be necessary must be identified and controlled.

Two things are worth separating. Availability is a control objective here, not only an access-restriction one: a procedure nobody can find during an incident fails this clause as surely as one anybody can alter.

The external-origin requirement is the one most often overlooked, and it matters more than it sounds. Supplier security documentation, a regulator’s guidance, a certification body’s criteria — where the ISMS depends on them, the organisation must know which version it is relying on.

How to put this in place

Documented information must be available when needed and protected from misuse or loss. Auditors check that the version people use is the current one.

Choose where documents are stored and who may read and edit them.
Control versions, and keep superseded ones where they should be kept.
Set retention and disposal rules for records.
Protect documents from loss and unauthorised change.
Include externally supplied documents.

Evidence an auditor usually looks for: a controlled store with access rights, version history, retention rules and current versions in use.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.
Statement of Applicability TemplateExcel
The SoA Approval sheet records the version, approval and distribution, and its instructions say to keep superseded versions.
Mandatory ISMS Documentation ChecklistExcel
The checklist's four checks, including whether each document is under document control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.