ISpectra Technologies
Requirements & ScopeGuideUpdated Jun 2026·9 min read

ISO 27001 Documentation: Required Documents & Records

ISO 27001 runs on documented information — the policies that describe how you work and the records that prove you do. This guide covers exactly which documents and records the standard requires, and how to manage them without drowning.

Share

Documentation is where many ISO 27001 projects feel heaviest, and where teams either over-produce (endless policies nobody reads) or under-produce (no evidence the system runs). The standard is actually quite specific about what it needs, and getting that right — no more, no less — is a skill worth learning early.

This guide lays out the mandatory documents and records, the difference between the two, and how to manage documentation so it supports your iso 27001 certification instead of burying it.

Documents vs records

ISO 27001 distinguishes two kinds of ‘documented information’. Documents describe how the ISMS is meant to work — policies, procedures, the scope, the risk method. Records are evidence that it actually worked — completed access reviews, change approvals, audit reports, training logs.

Both matter, and auditors examine both. A perfect set of documents with no records proves nothing operated; a pile of records with no documents shows no managed system. The two halves must align.

Keeping this distinction in mind helps you produce the right thing at the right time.

The mandatory documents

ISO 27001 explicitly requires certain documented information. The core set includes the ISMS scope, the information security policy, the risk assessment and risk treatment process, the Statement of Applicability, the risk treatment plan, and the information security objectives.

These are non-negotiable; an auditor will expect to see each one. Together they describe what your ISMS covers, how it decides what to protect, and what it is trying to achieve.

Get these foundational documents right and the bulk of the mandatory documentation requirement is met.

Free resource

ISO 27001 Policy Templates

Ready-to-edit policy & procedure templates for the mandatory ISO 27001 documentation.

The mandatory records

The standard also requires records that evidence the ISMS operating. These include results of risk assessments and treatment, evidence of competence and training, the results of monitoring and measurement, internal audit programmes and reports, management review outputs, and records of nonconformities and corrective actions.

Records are what prove the management cycle is turning. Without them, the clauses on operation, evaluation, and improvement cannot be demonstrated.

Because records accumulate over time, capturing them continuously is far easier than reconstructing them.

Supporting policies and procedures

Beyond the mandatory documents, most organisations maintain a set of topic-specific policies and procedures to support their controls — access control, acceptable use, cryptography, supplier security, incident response, and so on. ISO 27001 does not prescribe an exact list; your risk assessment and chosen controls determine what you need.

The guiding principle is sufficiency: enough documentation to operate consistently, not so much that it becomes unmaintainable. ISO 27002 helps you judge what each control genuinely needs.

Quality beats quantity — a few clear, followed policies outperform a binder of ignored ones.

How much documentation is enough?

A frequent worry is volume. The honest answer is: enough to ensure controls operate consistently and to evidence the clauses, and no more. ISO 27001:2022 deliberately avoids dictating a rigid document list precisely so you can right-size to your organisation.

A small company can run a compliant ISMS on a lean set of concise documents. A large enterprise will naturally need more. Padding documentation to look thorough usually backfires, because unused documents drift out of date and create audit findings.

Aim for documents people actually use; that is the standard’s real intent.

Document control

Clause 7.5 requires you to control documented information: ensure it is approved, identifiable, versioned, available where needed, and protected from improper changes or loss. In practice this means a sensible system for storing, versioning, and approving documents.

You do not need expensive software — a well-organised shared repository with clear ownership and version history can suffice — but you do need discipline. Auditors check that the policy in use is the current, approved version.

Out-of-date or unapproved documents in circulation are a common, easily avoided finding.

Using templates wisely

Templates dramatically accelerate documentation, letting you adapt proven structures rather than invent each document from scratch. They also help ensure you do not miss a required element. This is exactly why a starter kit of policy templates is such a common first step.

The caveat: a template must be tailored to your organisation, not pasted in unchanged. Auditors and staff alike spot generic documents that describe a company you are not. Adapt them to your real processes.

Used well, templates turn weeks of writing into days of sensible editing. Getting this right is a significant part of a smooth path to iso 27001 certification.

Keeping documentation alive

Documentation is not a one-time deliverable. Policies need periodic review, records accumulate continuously, and changes in the organisation must be reflected in the documents. A documentation set frozen at certification soon drifts from reality and produces surveillance findings.

Build review cycles into your maintenance rhythm — for example, an annual policy review — and capture records as a by-product of normal operations rather than in pre-audit bursts.

Living documentation is the mark of a healthy ISMS; stale documentation is the mark of a neglected one.

Common documentation mistakes

The recurring errors are over-documentation (volumes nobody maintains), under-documentation (no evidence of operation), generic templates left untailored, poor version control, and confusing documents with records. Each is avoidable with a right-sizing mindset and basic document hygiene.

Another is leaving documentation to the end — writing policies the week before an audit produces hollow documents that staff interviews quickly expose. Document as you build instead.

Avoid these and documentation becomes an asset rather than a chore.

Automating documentation and evidence

Compliance automation platforms increasingly manage both documents and records: hosting policies with version control and approvals, and continuously collecting evidence from your systems. This keeps documentation current and audit-ready with far less manual effort.

Even without a platform, simple automation — scheduled reviews, evidence pulled from existing tools — reduces the burden significantly. The goal is documentation that maintains itself as much as possible.

The less manual the upkeep, the more reliably it actually happens.

The bottom line

ISO 27001 requires a specific core of documents (scope, policy, risk method, SoA, treatment plan, objectives) and records that evidence the system operating, plus the supporting policies your controls need. The skill is right-sizing — enough to operate and evidence, no more.

Distinguish documents from records, control versions properly, use templates but tailor them, document as you build, and keep everything alive through review and continuous evidence capture.

ISpectra provides tailored, audit-ready documentation as part of every engagement — with free VAPT and a multi-framework discount — so you meet the requirement precisely without drowning in paperwork.

A minimum document set to start

If you want a concrete starting point, a lean but compliant document set looks like this: an ISMS scope statement, a top-level information security policy, a handful of supporting policies (access control, acceptable use, cryptography, supplier security, incident response), a risk assessment methodology, the risk treatment plan, the Statement of Applicability, and your security objectives.

Alongside those documents you begin capturing records: access reviews, change approvals, training completions, and later your internal audit and management review outputs. That combination satisfies the mandatory requirements for a typical small organisation.

Starting from this set — ideally via tailored templates — you add only what your specific risks and controls demand, keeping the documentation proportionate from day one.

Free consultation

Need help with ISO 27001?

Talk to our certified compliance team — we’ve supported 200+ audits.

Book free assessment
FAQ

ISO 27001 Documentation: Required Documents & Records — Frequently Asked Questions

The mandatory core includes the ISMS scope, information security policy, risk assessment and treatment process, risk treatment plan, Statement of Applicability, and security objectives, plus records evidencing operation, audits, and reviews.
Documents describe how the ISMS should work (policies, procedures, scope); records are evidence that it did work (completed reviews, approvals, audit reports, training logs). Auditors examine both.
Enough to ensure controls operate consistently and to evidence the clauses, and no more. The 2022 edition deliberately avoids a rigid list so you can right-size to your organisation.
Yes, and they save significant time, but you must tailor them to your real processes. Generic, untailored templates are easily spotted by auditors and staff.
Yes. Clause 7.5 requires documented information to be approved, versioned, available where needed, and protected. Auditors check that the version in use is the current, approved one.

Ready to get ISO 27001 certified?

ISpectra takes you from gap assessment to certificate — ISMS build, risk assessment, Annex A controls, evidence, and audit support in one program. Free VAPT included, and 10% off when you bundle multiple frameworks.