# The ISO 27001 documentation checklist that matches the standard.

What ISO/IEC 27001:2022 actually requires, what auditors expect to see, and what is worth adding once the basics are solid. Sorted into four tiers, with the clause or Annex A control for every item.

**Frameworks:** ISO 27001:2022, Amendment 1:2024, ISO 27002:2022, ISMS, POPIA

## Most "complete" document lists are not complete. They are padded.

Lists of 40 or 50 "essential" ISO 27001 documents circulate widely. They mix what the standard requires with consultancy templates, audit body outputs and one organisation's habits. The result is over-documentation that nobody maintains, while some genuine requirements still go missing. ISO/IEC 27001:2022 is shorter than that. Clauses 4 to 10 mandate a defined set of documented information. Annex A adds more, but only for the controls your Statement of Applicability includes. Everything else is your choice.

- Myth: "You need an ISMS manual." ISO 27001 does not require one. A short handbook can help people find their way, but no auditor can raise a finding for not having one.
- Myth: "Track preventive actions." Preventive action left the standard in 2013. Risk-based planning in clause 6 replaced it. Clause 10.2 covers corrective action only.
- Myth: "Write a document control procedure." Clause 7.5 requires you to control documents, not to write a procedure about it. A procedure is good practice, not a requirement.
- Myth: "External audit reports are ISMS documents." Your certification body writes those. Keep them as records, but they do not count towards your own documented information.

## Five traps that turn complete files into findings.

- SoA and treatment plan disagree. Every included control should trace to a risk, a legal requirement or a business need. Auditors test this link first.
- Objectives with no measure. Clause 6.2 asks how results will be evaluated. A goal with no metric, owner or date is a statement, not an objective.
- Uncontrolled documents. No version, owner, approval or review date. A great policy that is three years stale is still a finding.
- Thin management reviews. Clause 9.3.2 lists the inputs. Cover each one, including changes in interested party needs, which the 2022 edition added.
- Weak exclusions. "Not applicable" with no reason invites challenge. Justify every excluded control in one clear sentence.

## How it works

- Tier 1, must have: required by clauses 4 to 10 for every ISMS. Missing any of these is a likely nonconformity.
- Tier 2, must have if applicable: required when your Statement of Applicability includes the related Annex A control. Justify any exclusion.
- Tier 3, best practice: not mandated as documents, but auditors expect the evidence. Having it ready shortens the audit.
- Tier 4, nice to have: maturity builders that help the ISMS run smoothly and earn trust with the board and customers.

## On the platform

**From a team that holds the certificate** — XGRC® Software is certified to ISO/IEC 27001:2022. This checklist comes from running an ISMS, not only from reading the standard. Clause and control text is paraphrased, so check exact wording against your licensed copy of ISO/IEC 27001:2022 and ISO/IEC 27002:2022.

## Documents that stay current between audits.

| Manual approach | With XGRC® |
| --- | --- |
| Policies in shared folders with no review date | Controlled documents with owners, versions and review dates |
| Statement of Applicability out of step with the risk register | Statement of Applicability linked to risks and controls |
| Evidence gathered in the weeks before the audit | Audit evidence that builds up as work is done |
| Owners and versions tracked from memory | A live view of ISMS status for management review |

## Every document an ISMS needs, in order of priority.

- Mandatory documented information
- Annex A documents
- Audit-ready evidence
- Maturity builders

## Frequently asked questions

### What documents are mandatory for ISO 27001:2022?

Clauses 4 to 10 require documented information for the ISMS scope, information security policy, risk assessment and treatment processes, Statement of Applicability, risk treatment plan, objectives, evidence of competence, operational planning, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and nonconformities with corrective actions. Annex A adds documents only for the controls your Statement of Applicability includes.

### Is an ISMS manual mandatory for ISO 27001?

No. ISO 27001 does not require an ISMS manual. A short handbook can help staff and auditors understand how the ISMS fits together, but no auditor can raise a finding for not having one.

### Do I need a written document control procedure?

No. Clause 7.5 requires you to control documented information, including versions, approval, access and retention. Writing a procedure for it is good practice, not a requirement.

### Are ISO 27001:2013 certificates still valid?

No. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025. Certificates issued against the 2013 edition are no longer valid.

### Does a record in a system count as a document?

Yes. ISO 27001 sets no format for documented information. A controlled record in a system counts as much as a Word file, as long as it is identified, reviewed, approved and protected.

## Related solution

- [MSXCyber®](https://xgrcsoftware.com/msxcyber)

---

Source: https://xgrcsoftware.com/use-cases/iso-27001-documentation-checklist