ISO 27001:2022 · Documentation Checklist
The Documents ISO 27001 Actually Requires
Template vendors will sell you 80 documents. The standard explicitly requires about 14 — plus whatever your applicable Annex A controls demand. This checklist separates the three tiers: strictly mandatory, mandatory-when-applicable, and commonly expected. Each item links to the clause or control guide that explains how to write it.
Tier 1 · Always Mandatory
Required by Clauses 4–10
These are the places where ISO 27001:2022 explicitly states documented information shall be available or retained. No scope, no industry, no size exempts you from any of them.
ISMS Scope
Clause 4.3A statement of what the ISMS covers — locations, organizational units, services, and interfaces — and the reasoning behind any boundary decisions.
Information Security Policy
Clause 5.2The top-level policy approved by leadership: commitments, the framework for setting objectives, and the mandate for the ISMS.
Risk Assessment Process
Clause 6.1Your documented method for identifying, analyzing, and evaluating information security risks — criteria, scales, and ownership included.
Risk Treatment Process
Clause 6.1How risk treatment options are selected, controls are determined, and residual risk is approved by risk owners.
Statement of Applicability (SoA)
Clause 6.1The control-by-control declaration: which of the 93 Annex A controls apply, why, their implementation status — and justification for every exclusion.
Information Security Objectives
Clause 6.2Measurable security objectives at relevant functions and levels, with plans covering who does what, with what resources, by when.
Evidence of Competence
Clause 7.2Records demonstrating that people doing ISMS work are competent — certifications, training records, experience summaries.
Operational Planning & Control Records
Clause 8.1Documentation sufficient to show security processes are carried out as planned — runbooks, tickets, approvals at the depth your processes need.
Risk Assessment Results
Clause 8.2The retained output of each risk assessment cycle — typically your risk register with scores, owners, and dates.
Risk Treatment Results
Clause 8.3The risk treatment plan and evidence of its execution — selected controls, implementation status, and risk-owner approvals of residual risk.
Monitoring & Measurement Results
Clause 9.1Evidence of what you measured, how, when, and what the results showed — your ISMS metrics and their evaluation.
Internal Audit Programme & Results
Clause 9.2The audit programme (scope, frequency, methods) plus the reports of each internal audit performed.
Management Review Results
Clause 9.3Minutes and decisions from top-management reviews of the ISMS — inputs considered, improvement decisions, resource changes.
Nonconformity & Corrective Action Records
Clause 10.2The nature of each nonconformity, actions taken, and the verified results of corrective action — including root-cause analysis.
Tier 2 · Mandatory When the Control Applies
Driven by Your Statement of Applicability
Each Annex A control you mark applicable in the SoA brings documentation with it. These are the ones auditors sample on nearly every engagement.
Topic-Specific Security Policies
Access control, cryptography, incident management, supplier security, and similar policies — the working layer below the top-level policy.
Inventory of Information & Assets
The asset register with assigned owners — the backbone document most other controls reference.
Acceptable Use Rules
Documented rules for acceptable use and handling of information and assets, acknowledged by users.
Access Control Rules
The documented rules governing logical and physical access, derived from business and security requirements.
Supplier Security Agreements
Contracts or addenda embedding security requirements with each relevant supplier.
Incident Management Procedures
The incident response plan: roles, severity classification, escalation, communication, and evidence handling.
Incident Response Records
Documentation of how actual incidents were assessed, contained, and resolved.
Continuity & Disruption Plans
How information security is maintained during disruption, integrated with business continuity arrangements.
Legal & Regulatory Register
The documented inventory of legal, statutory, regulatory, and contractual security requirements and how each is met.
Documented Operating Procedures
Runbooks for security-relevant operations — backup, onboarding/offboarding, deployment, incident escalation.
Backup Records
Backup definitions (scope, frequency, retention) and evidence of restoration tests.
Change Management Records
Evidence that changes to systems and processing facilities follow defined change control.
Tier 3 · Expected, Not Mandated
What Auditors Ask For Anyway
Not named as documented information by the standard — but so universally used to evidence conformity that their absence invites questions. Know which ones you are choosing to skip.
Interested Parties Register
Stakeholders and their security-relevant requirements (clause 4.2 requires the analysis; a register is the standard way to evidence it).
Risk Register
The living operational form of your risk assessment results — universally expected even though the standard only names the results.
ISMS Roles & Responsibilities Matrix
A RACI or equivalent making clause 5.3 assignments visible — auditors ask for it by name.
Awareness & Training Records
Attendance and completion evidence supporting clauses 7.2–7.3 — expected at every audit.
Document Control Procedure
How documents are versioned, approved, and distributed per clause 7.5 — usually a short procedure plus register.
Communication Plan
Who communicates what about the ISMS, when, and to whom (clause 7.4) — a simple table satisfies it.
ISMS Manual
NOT required by ISO 27001:2022 at all — a 2005-era habit. A scope document, policy, and SoA make a separate manual redundant (see FAQ).
Rule of thumb from our audit work: if a document does not change a decision, prove a requirement, or tell someone what to do, it is shelf-ware — and auditors notice shelf-ware faster than gaps. Write the 20–35 documents your scope genuinely needs and keep every one of them alive.
Documentation FAQ
Common Documentation Questions
How many mandatory documents does ISO 27001:2022 require?
Is an ISMS manual mandatory in ISO 27001:2022?
Can we combine multiple mandatory documents into one?
What is the difference between documents and records in ISO 27001?
Do we need documents for Annex A controls we excluded in the SoA?
What format do ISO 27001 documents need to be in?
Written By Expert Auditors
Keep Exploring
Related Reading
ISO 27001 Knowledge Hub
All 93 Annex A controls, all clauses, every guide in the cluster.
Read moreISO 27001 Implementation
The phased ISMS build, from scoping to surveillance audits.
Read moreISO 27001 Templates
ISMS policy templates, SoA workbook, risk register, and audit checklists.
Read moreAnnex A Controls Overview
All 93 controls across organizational, people, physical and tech domains.
Read moreISO 27001 Certification Guide
The step-by-step path from gap assessment to certificate.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreGet in touch
Book a free consultation or send us your requirements. We respond within 24 hours.
Quick Call
Pick a time slot
Send Requirements
Get a custom quote in 24 hours