Key takeaways
- Create, update and control the documents and records the ISMS needs.
- Documents must be available when needed and protected from misuse.
- Start here: control distribution, access and storage.
Purpose
Create, update and control the documents and records the ISMS needs.
Requirement
Requirement summaryDocumented information required by the information security management system and by this document shall be controlled to ensure: **7.5.3 Control of documented information ** a) it is available and suitable for use, where and when it is needed; and b) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity). For the control of documented information, the organization shall address the following activities, as applicable: c) distribution, access, retrieval and use; d) storage and preservation, including the preservation of legibility; e) control of changes (e.g. version control); and f) retention and disposition. Documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled. NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information, etc.
Why it matters
Documents must be available when needed and protected from misuse.
How to implement
- Control distribution, access and storage.
- Protect against loss and unauthorised change.
- Manage versions and retention.
- Control external documents too.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.5.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for storing, sharing, protecting and archiving documents.
Records and examples to show
- Access settings for document storage.
- Proof old versions are archived and not used by mistake.
- Proof documents from outside sources (such as standards or contracts) are tracked.
Things you should be able to show or explain
- Be able to show that staff can find the latest version.
How much to show: Your main document location.
Common mistakes
- Old versions still in use.
- Anyone can edit controlled documents.
- Old versions still accessible.
- No retention rules.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Document control procedure
FAQ
Can we exclude clause 7.5.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Version control, approval, access, retention.