ISMS Documentation

The ISO 27001 standard requirements related to the contents and extent of the ISMS documentation are generic and logical. The term ”documented information” used by the standard covers records as well, but our focus is on policies and procedures for now. We also don’t want to list what documentation is needed, but how to create usable content.

Creating ISO 27001-compliant documentation doesn’t have to be overwhelming. ISO 27001 emphasizes tailoring the ISMS to your organizational context. This is where the downloadable document sets bleed: who is interested, what is the standard requirement, and why is a control important if that makes the documentation set 2-3 times longer? For example, access control procedures for a cloud-native startup will differ significantly from those of a healthcare provider. Write policies and procedures that consider your company’s size, industry, regulatory requirements, and risk appetite. Document existing practice and extend only where the standard requires more. Keep it concise: in many cases, where the standard requires a procedure or policy, the content adds up to a few paragraphs only –  keep them in a single document, don’t create many one-pagers. Use version-controlled documents and centralize them in a secure document management system (DMS/CMS), a write-protected folder, or an intranet. Ensure staff know where to find them. If you create documents, a standard format and naming convention make them easy to find and convenient to use.

If your organization already has process, security, or compliance policies (e.g., for ISO 9001, GDPR, or PCI DSS), don’t reinvent the wheel. Cross-reference existing policies and adjust only where necessary. This avoids duplication and promotes alignment between frameworks. This also emphasizes that policies stemming from the ISO standard don’t describe a different, new universe to be visited at the time of the audits only, it is still your company.

The common saying “Getting through the first 95 % of a task requires 95 % of the time allocated; doing the remaining 5 % takes another 95 % of the time” is true for writing ISMS documentation as well. Don’t aim to create a fully complete documentation set while implementing an ISMS. Publish and train your controls when you feel it is good enough. It will need to be fine-tuned anyway based on workforce comments, audits, risk assessments, and security incidents to ensure ongoing relevance and compliance.

Even the best-written policies are ineffective if employees don’t follow them. Provide training on critical procedures and responsibilities, such as incident reporting, password management, and secure data handling. Test workforce understanding and knowledge of the day-by-day controls and if they know where to find the rest. It is a common misconception that an attendance sheet satisfies standard requirements on training – it requires effectiveness evaluation.

13/05/2025