Information security / ISO/IEC 27001 / Audit readiness
ISO 27001:2022 Required Documents & Records
Use this checklist to verify which ISO 27001 documents to maintain, which records to retain, and what evidence to prepare for selected security controls.
For ISMS owners, security leaders, control owners, compliance teams, and internal auditors.
Short answer
ISO/IEC 27001:2022 requires an ISMS scope, information security policy, documented risk processes, Statement of Applicability, risk treatment plan and security objectives. It also requires retained evidence of competence, risk assessments and treatment, relevant operations, monitoring, internal audits, management reviews, and corrective actions.
Annex A contains 93 reference controls grouped into organizational, people, physical, and technological themes. Organizations determine necessary controls through risk treatment and document their reasoning in the Statement of Applicability (SoA). Not every Annex A control will be necessary for every ISMS. The SoA records which controls are needed, why, and whether they have been implemented.
Maintain means keep documented information current and controlled, such as the security policy or risk assessment process. Retain means preserve results, such as a completed risk assessment or internal audit report. The same system or register can contain both if they are clearly distinguishable and controlled.
2024 amendment: Clauses 4.1 and 4.2 now explicitly address climate-change relevance and related interested-party requirements. Assess these alongside other context factors when defining and reviewing the ISMS.
ISMS documentation
Required ISMS documents
Use these clause references to check that the information exists, identifies an owner, reflects current operations, and is properly controlled. The document name or file format can vary.
On a narrow screen, scroll the checklist sideways to see all columns.
| Check | Documented information | Clause | What to verify |
|---|---|---|---|
| ISMS scope | 4.3 | Boundaries and applicability, including locations, activities, interfaces, and dependencies where relevant. | |
| Information security policy | 5.2 | A policy established by top management, aligned with the ISMS purpose, communicated within the organization, and available to relevant interested parties as appropriate. | |
| Risk assessment process and criteria | 6.1.2 | Repeatable assessment process, risk criteria, and consistent methods for evaluating and prioritizing risks. | |
| Risk treatment process | 6.1.3 | The method for choosing treatment options and necessary controls, checking Annex A for omissions, and securing risk-owner approval and residual-risk acceptance. | |
| Statement of Applicability | 6.1.3(d) | Necessary controls; reasons for inclusion; implementation status; and justification for excluding Annex A controls. | |
| Risk treatment plan | 6.1.3(e–f) | Planned treatments, responsible owners and target dates; evidence that risk owners approved the plan and accepted the residual risks. | |
| Information security objectives | 6.2 | Relevant objectives, means of measurement where practicable, and plans to achieve them. |
Document the operation, not just the design. Under Clause 8.1, keep enough information to show that planned ISMS processes were carried out. Clause 7.5.1(b) also covers documentation your organization determines is needed for an effective ISMS. Use procedures, tickets, logs or other records appropriate to the work.
Checklist selections are temporary and are not saved or transmitted.
Evidence of performance
Records the ISMS must retain
Retained records show what happened: assessments completed, controls operated, results reviewed, and problems corrected. They may be stored together if individual results remain identifiable.
On a narrow screen, scroll the checklist sideways to see all columns.
| Check | Retained evidence | Clause | What to verify |
|---|---|---|---|
| Competence evidence | 7.2 | Suitable records of competence for people whose work affects information security performance. | |
| Risk assessment results | 8.2 | Assessed risks, evaluation results, dates or change triggers, and the basis for prioritization. | |
| Risk treatment results | 8.3 | Retained results of implementing the treatment plan: completed actions, status, exceptions and evidence of implemented safeguards. | |
| Operational execution evidence As necessary | 8.1 | Tickets, logs, reviews, or other records that demonstrate planned security processes were carried out, to the extent necessary. | |
| Monitoring and measurement results | 9.1 | Relevant measures, methods, dates, results, and evaluation of ISMS performance or control effectiveness. | |
| Internal audit programme and results | 9.2.2 | Evidence that the audit programme was implemented, with audit scope, criteria, results and reporting to relevant management. | |
| Management review results | 9.3.3 | Management review results, including decisions on improvement opportunities and any required changes to the ISMS. | |
| Nonconformity and corrective action records | 10.2 | Nature of nonconformities, subsequent action taken, and results of corrective action. |
Set retention by record type. Define how long each category is kept, who can access it, and how it is protected and disposed of. Base the period on legal, contractual, operational and audit needs rather than applying an arbitrary four-year rule.
Annex A and the Statement of Applicability
Control-specific evidence depends on applicability
Annex A helps verify that your risk treatment process has not missed relevant security controls. For every control selected in the SoA, identify the person responsible, what is implemented, and what evidence demonstrates it. ISO/IEC 27002:2022 provides additional implementation guidance for these controls.
Organizational controls
Assets, suppliers, incident response
Check the asset inventory (A.5.9), supplier assessments and reviews (A.5.19–A.5.22), incident handling records (A.5.24–A.5.28), and relevant operating procedures (A.5.37).
People and physical controls
Responsibilities, awareness, access
Look for awareness and training evidence (A.6.3), remote-work safeguards (A.6.7), and physical entry or access records appropriate to the site.
Technological controls
Backups, logging, changes
Sample backup and restoration evidence (A.8.13), event logs (A.8.15), monitoring records (A.8.16), configuration changes (A.8.9), and change approvals (A.8.32).
Check the SoA against reality. If a necessary control is still being implemented, show its actual status, planned completion, responsible owner and related treatment decision.
How auditors examine an ISMS
Trace the requirement to the result
A file list tells an auditor what exists. A risk-to-control trace shows whether decisions and operating evidence agree. Start with one significant risk and follow it end to end.
- Scope
- Confirm that the activity and affected information sit within the ISMS boundary.
- Risk
- Locate the assessment, scoring basis, treatment decision, and owner.
- Control
- Compare treatment to the SoA and examine the implemented safeguards.
- Evidence
- Sample operating records, exceptions, monitoring, and management responses.
Example / Access review
Prove that access control works
Risk: former employees retain sensitive access. Treatment: revoke access promptly and review entitlements. SoA: link to the selected access-rights control (for example, A.5.18). Evidence: sampled departure records, approval or revocation logs, exceptions and follow-up.
What to check before the certification audit
- Coverage
- Do required documents and results exist for the actual scope? Are necessary Annex A controls addressed in the SoA?
- Consistency
- Do scope, assessment criteria, risk owners, treatment decisions and SoA implementation status agree?
- Operation
- Are controls in use, and does sampled evidence support the claimed implementation status?
- Current status
- Are documents reviewed and updated when required by the organization’s own controls or significant changes?
- Follow-through
- Can management show how findings, incidents, internal audits, and corrective actions affected subsequent decisions?
Audit findings: A missing required record can lead to a nonconformity. Its classification depends on the scope and significance of the failure, including whether it reflects a wider ISMS weakness.
Practical maintenance
Maintain one controlled evidence inventory
Maintain a searchable index with each item’s name, clause or control reference, owner, location, version or evidence period, approval status where relevant, access restrictions, retention period and review trigger.
Link the risk register, treatment plan, SoA, monitoring results and corrective actions through stable IDs or record links. This lets reviewers follow the history without maintaining duplicate files.
Common questions
ISO 27001 documents and records: FAQ
Which documents are mandatory for ISO 27001:2022?
At minimum, maintain a defined ISMS scope, information security policy, documented risk assessment and treatment processes, Statement of Applicability, risk treatment plan and information security objectives. You also need the retained records specified in Clauses 7–10, plus other documented information necessary for your actual controls and processes.
Does ISO 27001 require all 93 Annex A controls?
No. The organization determines necessary controls through its risk treatment process, compares those decisions with Annex A, and justifies inclusion and exclusion in the Statement of Applicability. Applicable legal, regulatory, and contractual obligations can affect those decisions.
Is an operational planning and control SOP mandatory under Clause 8.1?
No. Clause 8.1 requires operational processes to be planned and controlled, with enough records to show they were carried out as intended. It does not specify one standalone SOP for every organization.
Must every ISMS document be updated annually?
No. Set review intervals suited to the document and the organization’s needs. Update documents sooner when system changes, incidents, findings, or other events make their contents inaccurate.
Does ISO 27001 require separate initial-risk and residual-risk registers?
No. One register can track initial assessments, treatment actions and residual risks as long as changes, decisions and approvals remain clear.
How long should ISO 27001 audit evidence be retained?
ISO/IEC 27001 does not set a blanket three- or four-year period. Specify retention for each record type based on law, contracts, business needs and the evidence needed for audit.
Does the 2024 amendment require a new climate risk register?
No. Evaluate climate-change relevance in the ISMS context and any related interested-party requirements under Clauses 4.1 and 4.2. A separate register is optional.
Standards
- ISO/IEC 27001:2022. Requirements for information security management systems, including Clauses 4–10 and Annex A. ISO standard record.
- ISO/IEC 27001:2022/Amd 1:2024. Climate-action amendment affecting Clauses 4.1 and 4.2. ISO amendment record.
- ISO/IEC 27002:2022. Implementation guidance for information security controls. ISO standard record.
InfoSecured.ai · Editorial standards · Suggest a correction