Key takeaways
- Create, update and control the documents and records the ISMS needs.
- Good document creation practices make information clear and trustworthy.
- Start here: use consistent identification: title, date, owner, version.
Purpose
Create, update and control the documents and records the ISMS needs.
Requirement
Requirement summaryWhen creating and updating documented information the organization shall ensure appropriate: a) identification and description (e.g. a title, date, author, or reference number); b) format (e.g. language, software version, graphics) and media (e.g. paper, electronic); and c) review and approval for suitability and adequacy.
Why it matters
Good document creation practices make information clear and trustworthy.
How to implement
- Use consistent identification: title, date, owner, version.
- Choose suitable formats and media.
- Review and approve documents before use.
- Track changes in version history.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.5.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your document control rules: titles, version numbers, owners, approval and review.
Records and examples to show
- Documents showing version, owner and approval.
- Approval records showing documents were signed off before use.
Things you should be able to show or explain
- Be able to show how a new version is approved.
How much to show: A handful of documents.
Common mistakes
- Unapproved drafts in use.
- No version history.
- Documents with no owner or date.
- Unapproved drafts in circulation.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Document control procedure
FAQ
Can we exclude clause 7.5.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Version control, approval, access, retention.