Documented information

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The ISMS has to include both the documented information this standard requires and whatever further documented information the organization judges it needs for an effective ISMS. The note says the amount can vary with the size and type of organization, the complexity of processes and how they interact, and the competence of people.

How the 2020 guidance taught the audit

Auditors confirm that the ISMS holds both the documented information that ISO/IEC 27001 calls for and the documented information the organization has itself judged necessary for an effective ISMS; the factors to weigh are the items listed as audit evidence, from the scope, policy and objectives through competence evidence, external documents, the risk processes, the Statement of Applicability, operating records, risk results, monitoring results, the audit programme and results, management review results and nonconformity and corrective action records. The phrase documented information retained as evidence replaces the older term records. Documented information may be in any format and medium and may have been created for purposes other than ISO/IEC 27001. Auditors confirm it is created and controlled in line with 7.5.2 and 7.5.3.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change. The clause still requires the documented information the ISMS needs and the documents the standard names.

Evidence an auditor asks for

• Documented informationInventory or library of the documented information the ISMS maintains and retains
• Documented informationThe documents and records ISO/IEC 27001 requires (scope, policy, objectives, risk processes and results, SoA, competence evidence, audit and review results, nonconformity records)
• Documented informationDocumented information the organization chose to add for effectiveness, with the reason

The questions an auditor will ask

Ask for the document register and test whether a document named by the standard is present and current.

Common gaps

• A required item missing, for example no retained evidence of risk treatment results
• Organization never decided what extra documented information it needs
• Records insisted on in a set format when the standard leaves form and medium open

Prepare before the next audit

Reconcile the document register with the 2022 Standard. Remove documents nobody uses and add the missing ones.

Cross-references

5.5.7