ISO 27001 Document and Record Policy: How to Write (& Template)

Time needed: 1 hour and 30 minutes

How to write an ISO 27001 Document and Record Policy

1. Create your version control and document mark-up

   ISO 27001 documents require version control of the author, the change, the date and the version as well as document mark up such as document classification.

2. Write the ISO 27001 Document and Record Policy contents page

   Document Contents Page
   Documents and Records Policy
   Purpose
   Scope
   Principle
   Creating and Updating
   Availability of documents
   Document Storage
   Version Control and Approval
   Policy documents
   Operational Documents and Records
   Example of Records
   Preservation of legibility
   Obsolete documents and records
   Documents of External Origin
   Document Classification

3. Write the ISO 27001 Document and Record Policy purpose

   The purpose of this policy is the control of documents and records in the information security management system.

4. Write the ISO 27001 Document and Record Policy principle

   Documents required for the information security management system are controlled, managed and available.

5. Write the ISO 27001 Document and Record Policy scope

   The documented information security management system.
   Documented information required by ISO 27001.
   Documented information determined by the company as being necessary for the effectiveness of the Information Security Management System.
   All employees and third-party users.

6. Describe the requirements when creating and updating documentation

   When creating and updating documented information, the company ensure appropriate
   – identification and description (e.g., a title, date, author, or reference number),
   – format (e.g., language, software version, graphics) and media (e.g., paper, electronic), and review and approval for suitability and adequacy.

7. Explain the approach to availability of documents

   The latest approved version of document is presented to the appropriate users and are available and suitable for use, where and when it is needed.

8. Document the document storage controls

   Documents are stored in the document management technology implemented at the company.
   Working documents for the information security management system are stored in the information security project / team folder.
   Live documents and records are held within the relevant departments folder in a secure environment.
   All stored documents are subject to access controls and adhere to the access control policy.
   Documents and records are available to those that require them for their role.

9. Describe the process of version control and approval

   Policy documents
   Policy documents are subject to change as a result of the continual improvement process.
   Changes to policy documents are done by the information security management team.
   Policy documents are approved by the Management Review Team.
   Policy documentation version control history is maintained which captures as a minimum the author, the date, the change, the new version number.
   Policy version controls follows an x.y numbering system where x is the release and y is the iteration. The release number is updated periodically as part of a periodic review for all policies and the policies issued as a release set.
   Operational Documents and Records
   Operational documents and records are updated by the document and / or process owner as part of day-to-day operations and as required.
   Changes to operational documents and records are done by the process owner.
   Operational documentation version control history is maintained which captures as a minimum the author, the date, the change, the new version number.
   Records may have version control history which is maintained which may capture as a minimum the author, the date, the change, the new version number.

10. Provide examples of records

    Records are evidence of an event and used for operational management and auditing. They include but are not limited to
    – Meeting minutes
    – Training records
    – Audit Reports
    – Incident Reports

11. Explain preservation of legibility

    Documents are created and available in electronic format using standard, supported office applications or in native operational systems.

12. Describe the controls for obsolete documents and records

    Obsolete documents and records required for audit and/or legal and regulatory purposes are archived in line with the data retention policy and removed from general accessibility.
    Obsolete documents and records that are not required for audit and/or legal and regulatory purposes are deleted in line the data retention policy.

13. Set out the controls for documents of external origin

    Documented information of external origin determined by the company to be necessary for the planning and operation of the Information Security Management System are identified, as appropriate, and controlled.

14. Explain the approach to document classification

    Documents are classified in line with the Information Classification and Handling policy.