ISO 27001:2022 mandatory documents: list by clause
ISO/IEC 27001:2022 requires documented information for: the ISMS scope (4.3), the information security policy (5.2), the risk assessment and treatment processes and their results (6.1.2, 6.1.3, 8.2, 8.3), the Statement of Applicability (6.1.3 d), security objectives (6.2), evidence of competence (7.2), operational planning (8.1), monitoring and measurement results (9.1), the internal audit programme and results (9.2), management review results (9.3), and nonconformities and corrective actions (10.2).
Mandatory documented information by clause
| Clause | Document or record | Type |
|---|---|---|
| 4.3 | ISMS scope | Document |
| 5.2 | Information security policy | Document |
| 6.1.2 | Risk assessment process (methodology) | Document |
| 6.1.3 | Risk treatment process and risk treatment plan | Document |
| 6.1.3 d) | Statement of Applicability | Document |
| 6.2 | Information security objectives | Document |
| 7.2 | Evidence of staff competence | Record |
| 8.1 | Information giving confidence that processes are carried out as planned | Record |
| 8.2 | Results of risk assessments | Record |
| 8.3 | Results of risk treatment | Record |
| 9.1 | Monitoring and measurement results | Record |
| 9.2.2 | Audit programme and audit results | Record |
| 9.3.3 | Results of management reviews | Record |
| 10.2 | Nonconformities, actions taken and results of corrective actions | Record |
Documented information the organization decides on
Clause 7.5.1 b) adds any documented information the organization determines is necessary for the effectiveness of the ISMS. In practice this covers procedures (document control, internal audit, corrective action, change management) and the operational records that show controls are working.
Documents commonly expected for Annex A controls
Several Annex A controls are best demonstrated with documents. They are not mandatory on their own, but if the control applies, the auditor will expect evidence such as:
- Topic-specific policies: access control, acceptable use, classification, suppliers, cloud, remote working, backup, cryptography (5.1, 5.10, 5.12, 5.15, 5.19, 5.23, 6.7, 8.13, 8.24).
- Inventory of information and other associated assets (5.9).
- Documented operating procedures (5.37).
- Information security incident management (5.24 to 5.28).
- Identified legal, statutory, regulatory and contractual requirements (5.31).
- Information security during disruption and ICT readiness (5.29, 5.30).
How to organize the documentation
A simple structure makes audits easier: a master index with the code, version, owner and review date of every document; folders by clause (context, leadership, planning, support, operation, performance evaluation and improvement); and a folder of Annex A policies. What matters is that each document is approved, version-controlled and available to the people who need it (clause 7.5.3).
NexoDocs documentation toolkit
The NexoDocs toolkit brings together 84 Word and Excel files organized by stage: the mandatory documents, 22 policies for Annex A controls, registers with formulas, a master index and completed examples for a fictional company. Every document must be adapted to your organization. You can try the reduced risk matrix for free.
Frequently asked questions
How many mandatory documents does ISO 27001:2022 have?
It depends on how you group them: about 14 items of documented information are required by clauses 4 to 10, plus whatever the organization determines necessary and whatever the applicable Annex A controls call for.
Are procedures mandatory?
The standard does not require procedures with specific names, but it does require sufficient documented information. Most organizations document at least document control, internal audit and corrective action.
What changed in documentation since the 2013 version?
Planning of changes (6.3) was added and Annex A went from 114 to 93 controls in 4 themes, so the Statement of Applicability and the policies need updating.
Does having all the documents guarantee certification?
No. The auditor checks that documents are applied and that there is evidence; certification is granted by a certification body after its audit.
Related guides
- ISO 27001 risk assessment template: what it must include and how to use it
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
- What is an ISMS and how do you implement it with ISO 27001?
Updated: 2026-10-20