Skip to main content
All measures

Measure · ISO 27001 and other standards

Control documented information

Determine which information is needed, approve specific versions and keep the current version findable, protected and readable.

Accountable: Document owners with approving roles and the ISMS leadReviewed

Reuse existing records

Reuse handbook chapter 7 and the existing document repository. Protecting information defines classification, labelling and handling; this measure does not create another classification table.

What to do

  1. 1

    Identify needed information and its authoritative location

    Review what ISO requires and what additional information you need for an effective ISMS. Include necessary external documents. For each record, determine its purpose, owner and authoritative location. Keep these details in the existing folder structure or document overview.

  2. 2

    Review and approve a specific version

    Identify the information appropriately, for example with a title, date, version or reference. Choose understandable language, a suitable format and medium. Have the specific version reviewed and approved for suitability and adequacy before use. Record the approved version, decision and responsible role at the document or existing record. Change or file history can support this, but does not resolve an ambiguous approval decision.

  3. 3

    Control use, changes and retention

    Make the current version available where and when it is needed. Set distribution, access, retrieval, use and protection according to Protecting information. Distinguish viewing rights from change rights and protect necessary evidence from unintended changes. Preserve readability and necessary older result records, control version changes and identify obsolete versions. Set suitable retention and disposal arrangements and identify required external documents and their current versions. Use existing file or version history and check references when changes are made.

Worked example

A revised working rule is to apply to the team

Fictitious example: The team maintains the policy in its existing document repository. The handbook defines the workflow.

Approval
DecisionThe responsible role reviews version 1.3 and records approval and its date in the existing record. The published file matches that version.
EvidenceClearly identified version and approval decision.
Use
DecisionThe central link points to the current version. The previous version remains in the necessary history but is no longer presented as the current working rule. Access matches the classification.
EvidenceCurrent link, suitable permissions and traceable version change.

Record the result

  • Allocation of required internal and external information to its authoritative location and owner.
  • Identifiable versions with suitable review and approval.
  • Available, protected and readable records with controlled changes, retention and disposal.

Common implementation mistakes

Keep using every copy as the working version

Link to the current version. Retain necessary older evidence without confusing it with applicable working rules.

Treat version approval and periodic review as the same thing

Approval concerns specific content. A later review determines whether that content remains suitable. Send revised versions for approval again.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 7.5.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The measure identifies documented information required by the standard and additional information necessary for an effective ISMS. The information needed for the particular ISMS remains to be determined by the organisation.

    Reference

  • ISO/IEC 27001 · 7.5.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Identification and description, suitable format and medium, and review and approval of the specific version are handled in existing records. The organisation must create the actual content and approve it appropriately.

    Reference

  • ISO/IEC 27001 · 7.5.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Availability and protection are connected to appropriate distribution, access, retrieval, use, storage, readability, changes, retention and disposal. Required external information is identified and controlled; access and storage must actually be configured appropriately.

    Reference

Templates for your implementation

Related resources

Sources and further reading