The term "Documented information" is used within ISO 27001:2022 27 times. There is no one correct way to manage your documented information but the following are some key documents you would be expected to maintain.

DocumentDescriptionNotes
ISMS ManualA document for defining the scope of the ISMS, who relevant stakeholders are, their needs, and who is responsible for what within the ISMS.

This is ideal for holding documented information pertaining to:

  • Clause 4: Context of the organization
  • Clause 5.3: Organizational roles, responsibilities and authorities
Information Security PolicyA high-level document outlining the organization's approach to information security.

Pertains to:

  • Clause 5.2: Information Security Policy
Risk Assessment and Treatment MethodologyA defined process to ensure that information security risk assessments are consistent, valid, and comparable.

Pertains to:

  • Clause 6.1.2: Information security risk assessment
  • Clause 6.1.3: Information security risk treatment
Statement of Applicability (SoA)A document listing necessary controls, justifications for their inclusion or exclusion, and their current implementation status.

Pertains to:

  • Clause 6.1.3 d): Statement of Applicability
Information Security ObjectivesDocumented goals that are consistent with the Information Security Policy.

Pertains to:

  • Clause 6.2: Information security objectives
Risk Assessment and Treatment ResultsEvidence that risk assessments and treatment plans have been performed and implemented as planned.

Pertains to:

  • Clause 8.2: Information security risk assessment
  • Clause 8.3: Information security risk treatment
Internal Audit Programme and ResultsDocumentation of the audit schedule and evidence of the audit results to prove the ISMS is effectively maintained.

Pertains to:

  • Clause 9.2: Internal audit
Management Review ResultsEvidence of the outcomes from top management's reviews of the ISMS, including decisions on improvements.

Pertains to:

  • Clause 9.3: Management review
Nonconformity and Corrective Action LogsRecords detailing the nature of nonconformities, actions taken to correct them, and the results of those actions.

Pertains to:

  • Clause 10.2: Nonconformity and corrective action