ISO/IEC 27001:2022 never uses the words policy pack or mandatory documents. It says documented information, and it asks for it in a small number of named places. Everything else is your decision: clause 7.5.1 says you also keep whatever documented information you decide the management system needs to be effective.
That gives two lists. The first is fixed by the standard and an auditor will ask for each item at Stage 1. The second depends on which Annex A controls you declare applicable. Both are below, with the clause or control beside each line so you can check the wording in your own copy of the standard.
Documents the clauses require
These describe how the management system works. They exist before the audit and are kept up to date under document control.
| Clause | Document | What an auditor looks for |
|---|---|---|
| 4.3 | Scope of the ISMS | Locations, services and interfaces are named, and anything left out is explained. |
| 5.2 | Information security policy | Approved by top management, communicated, and consistent with the objectives. |
| 6.1.2 | Risk assessment process | Criteria for accepting risk and a method that gives comparable results each time. |
| 6.1.3 | Risk treatment process | How options are chosen and how controls are compared with Annex A. |
| 6.1.3 d) | Statement of Applicability | Every Annex A control addressed, with a justification and an implementation status. |
| 6.1.3 e) | Risk treatment plan | Actions, owners and dates, approved by the risk owners along with the residual risk. |
| 6.2 | Information security objectives | Measurable where practicable, with who, what resources and by when. |
Records the clauses require
Records are evidence that something happened. They are produced by running the system, so most of them cannot be written the week before the audit.
| Clause | Record | Typical form |
|---|---|---|
| 7.2 | Evidence of competence | Training records, certificates, CVs, skills matrix. |
| 8.1 | Evidence that processes were carried out as planned | Tickets, change records, completed checklists, logs. |
| 8.2 | Results of risk assessments | The risk register, with dates of each assessment. |
| 8.3 | Results of risk treatment | Treatment plan status and evidence of completed actions. |
| 9.1 | Results of monitoring and measurement | Metrics and the reports they feed. |
| 9.2 | Internal audit program and audit results | Annual program, audit plans, reports. |
| 9.3 | Results of management reviews | Minutes covering every input the clause lists. |
| 10.2 | Nonconformities and corrective actions | A log with cause, action taken and a check that the action worked. |
Annex A controls that ask for something documented
Annex A has 93 controls. Most say what must be achieved and leave the form to you. A few use the word documented, or name a document outright. These apply only if the control is applicable in your Statement of Applicability, which for most organizations it is.
| Control | What is asked for |
|---|---|
| 5.1 | An information security policy and topic-specific policies, approved, published and reviewed. |
| 5.9 | An inventory of information and other associated assets, with owners. |
| 5.10 | Rules for acceptable use of information and assets, documented. |
| 5.26 | Incident response carried out according to documented procedures. |
| 5.31 | Legal, statutory, regulatory and contractual requirements, documented and kept up to date. |
| 5.37 | Operating procedures, documented and available to the people who need them. |
| 6.6 | Confidentiality or non-disclosure agreements, documented, reviewed and signed. |
| 8.9 | Configurations of hardware, software, services and networks, documented. |
| 8.27 | Secure system architecture and engineering principles, documented. |
Documents nobody requires but every audit expects
- A document control procedure. Clause 7.5 sets requirements for creating, approving and controlling documents without asking for a written procedure. Without one, version and approval evidence is hard to show.
- An internal audit procedure and a corrective action procedure. The 2022 text asks for the results, not the procedure, but auditors ask how you plan audits and how you decide a fix has worked.
- A list of interested parties and their requirements (clause 4.2) and of internal and external issues (clause 4.1). These must be determined. Writing them down is the only practical way to show that.
- Roles and responsibilities (clause 5.3). They must be assigned and communicated.
- A communication plan (clause 7.4): what is communicated, when, to whom and how.
How to build the set without drowning in paper
- Start with scope, the risk method and the risk assessment. The Statement of Applicability and most policies follow from what the assessment finds.
- Write policies short. A policy states the rule and who owns it. The steps belong in a procedure that can change without re-approval by top management.
- Give every document an owner, a version, an approval and a review date on its first page. Auditors sample this before they read the content.
- Start collecting records on day one. Three months of real records is a common expectation before a certification audit, and they cannot be backdated.
- Delete what you do not do. A procedure that describes a process nobody follows is a nonconformity you wrote yourself.