Mandatory documents for ISO 27001 compliance

Organisations that implement ISO 27001 must demonstrate their compliance by completing appropriate documents.

ISO 27001’s mandatory documents include:

Annex A documentation

Organisations must also complete documents in Annex A, which details a list of information security controls that must be considered – whether they are implemented or not.

Indeed, you don’t have to implement all 114 of its controls; they are simply a list of possibilities you should consider based on your organisation’s requirements.

However, there are several controls that almost every organisation should implement. This includes:

  • 7.1.2 and A.13.2.4 Definition of security roles and responsibilities
  • 8.1.1 An inventory of assets
  • 8.1.3 Rules for the acceptable use of assets
  • 8.2.1 Information classification scheme
  • 9.1.1 Access control policy
  • 12.1.1 Operating procedures for IT management
  • 12.4.1 and A.12.4.3 Logs of user activities, exceptions, and security events
  • 14.2.5 Secure system engineering principles
  • 15.1.1 Supplier security policy
  • 16.1.5 Incident management procedure
  • 17.1.2 Business continuity procedures
  • 18.1.1 Statutory, regulatory, and contractual requirements

Looking for help documenting ISO 27001 compliance

Given the number of ISO 27001 policies you need to complete and the lack of guidance from the Standard, the documentation stage can be incredibly time-consuming and stressful.

There is no right way to approach the process, but organisations usually commit to one of three methods.

The first is trial and error, which we wouldn’t recommend. The documentation process is too big to go into without a plan, and even though you’ll quickly learn from your mistakes, you’ll burn through a lot of money doing so.

The second method is to bring in consultants to guide you through what you need to know. This is the most expensive approach, but it’s also the safest, reducing the risk of costly mistakes.

This approach is also the fastest route to ISO 27001 compliance, but don’t expect overnight success: consultants will need to learn your systems and processes before they can begin.

The third method is to purchase a documentation toolkit. These are packages that contain template documents and tools to help you meet the Standard’s requirements.

Some toolkits, such as IT Governance’s ISO 27001 Toolkit, include direction and guidance from expert ISO 27001 practitioners.

Why choose our ISO 27001 Toolkit?

With our ISO 27001 Toolkit, you can halve your implementation costs and receive guaranteed compliance with the Standard.

You’ll receive more than 140 customisable ISO 27001 documentation templates, including policies, procedures, work instructions and records.

The toolkit also comes with tools to help you complete the gap assessment, Statement of Applicability and roles and responsibilities matrix, as well our Implementation Manager tool and two staff awareness e-learning licences.

Find out more

A version of this blog was originally published on 27 October 2017.