ISO27001:2013 Documentation Requirements: A Comprehensive Guide

Documentation Requirements set out in ISO/IEC 27001:2013

For those of you who are currently 'transitioning' to the 2013 version of ISO27001, and who want to keep any additional workload down to a bare minimum, let's start with the optimistic news: No changes should be required to your existing documented procedures concerning control of documentation. However, as for the documents themselves, a lot will depend on the approach that you take to the transitioning process itself.

Here's why. A transition strategy might be one of the following options:

1. A straightforward “make-over”, taking the minimum necessary changes to the existing ISMS processes and existing documentation; or
2. Take a completely fresh look at the ISMS, using the revised standard to make improvements, which might be quite significant for some organisations.

There are some really good reasons to go for option 2 that merit several more future blog posts, but for the time being, I shall assume that you simply want to make updates to your existing ISMS documentation in time for the assessor's next visit. Also, because you are human, you've left this rather late and don't want to look as if you haven't prepared as well as you should before the fateful day dawns. As always with ISO compliance, the main thing to remember before you make a start is that you need to attend to the Requirements of the Standard first, however tempting it may be to reorganise your Controls; especially given the fact that by now you have probably had the time to peruse for yourself the 114 Control objectives and Controls in the 2013 version of Annex A and realise that they have, to quote an authority on ISO27001 "got mixed up quite a bit".

At this point, it's also worth delivering a timely reminder of the fact that no two organisations are identical in terms of their documentation needs - something that a DMS software developer like CogniDox is fully aware of.

A Note in Clause 7.5 of ISO27001:2013 says: "The extent of Documented Information can differ from one organisation to another due to:

1. the size of organization and its type of activities, processes, products and services
2. the complexity of processes and their interactions; and
3. the competence of persons.

As was the case with the 2005 version, the best advice is not to make life complicated for yourself and your organisation by generating too many documents or going for the 'fine-grained' detail - no matter how tempting!

Identify first what Documented Information is required by the Standard.

Which documents and records are required by ISO27001:2013?

The requirements for documented information are spread throughout the standard. Here's a document checklist and the relevant clause numbers.

Cautionary note:– The standard allows other documents to be added to improve the level of information security; therefore, what you see above is by no means a definitive list of documents and records that can be used during the ISO 27001 implementation. For example, organisations often include in their information security management system non-mandatory policy, procedure and control documents such as the ones shown below:

After you have determined the boundaries and applicability of the ISMS to establish its scope, it is then necessary to make the scope available, both within the organisation and to interested parties. The 2013 wording says:

"the scope shall be made available as documented information (4.3), and this term is used in other clauses; for example, from Clause 5.2 Policy:

The information security policy shall:

e) be available as documented information;

f) be communicated within the organization; and

g) be available to interested parties, as appropriate.

Documented Information that defines the chosen Risk Assessment Process and Risk Treatment Process required by ISO27001:2013

Documented Information in ISO27001:2013 includes the definition of the risk assessment process that establishes and maintains risk acceptance criteria and criteria for performing risk assessments. The documented results of the risk assessment should identify security risks associated with loss of Confidentiality, Integrity and Availability and the Risk Owners.

These risks are then analyzed in terms of their potential consequences, the realistic likelihood of occurrence is determined, and the levels of risk. It is necessary to define and apply an information security risk treatment process to; select treatment options,

• Determine controls "from any source"
• Compare controls with Annex A
• Produce a Statement of Applicability
• Formulate a treatment plan
• Obtain owners approval of treatments and residual risks

And...

• Retain documented information.

At this point, it is worth a moment to reflect that ISO27001:2013 aligns with the principles and generic guidelines provided by ISO31000, a family of standards in which risk management principles, policy, framework and process documentation, the risk culture of the organisation, and the risk recording and sharing system, are all touched upon in the documentation.

If you would like more information and guidance about ISO27001:2013 Requirements, including Risk Assessment Process options and selecting Control objectives and Controls, I will be writing about this subject in a later post - let me know that you are interested by posting a comment!

Next time: Cyber Essentials: what's all the fuss about another self-assessment process and what is this rumour about penetration testing?

This guest post was written by Michael Shuff. You can email him here.

Find out more about Cognidox Document Management solutions for ISO standards-compliance by downloading our Information Security white paper at http://www.cognidox.com/cognidox/view/VI-403566-TM