ISO Readiness · ISO/IEC 27001:2022

The ISO 27001 documentation checklist that matches the standard.

What ISO/IEC 27001:2022 actually requires, what auditors expect to see, and what is worth adding once the basics are solid. Sorted into four tiers, with the clause or Annex A control for every item.

Book a demo
The problem

Most "complete" document lists are not complete. They are padded.

Lists of 40 or 50 "essential" ISO 27001 documents circulate widely. They mix what the standard requires with consultancy templates, audit body outputs and one organisation's habits. The result is over-documentation that nobody maintains, while some genuine requirements still go missing. ISO/IEC 27001:2022 is shorter than that. Clauses 4 to 10 mandate a defined set of documented information. Annex A adds more, but only for the controls your Statement of Applicability includes. Everything else is your choice.

Myth: "You need an ISMS manual." ISO 27001 does not require one. A short handbook can help people find their way, but no auditor can raise a finding for not having one.

Myth: "Track preventive actions." Preventive action left the standard in 2013. Risk-based planning in clause 6 replaced it. Clause 10.2 covers corrective action only.

Myth: "Write a document control procedure." Clause 7.5 requires you to control documents, not to write a procedure about it. A procedure is good practice, not a requirement.

Myth: "External audit reports are ISMS documents." Your certification body writes those. Keep them as records, but they do not count towards your own documented information.

Before the auditor arrives

Five traps that turn complete files into findings.

01

SoA and treatment plan disagree. Every included control should trace to a risk, a legal requirement or a business need. Auditors test this link first.

02

Objectives with no measure. Clause 6.2 asks how results will be evaluated. A goal with no metric, owner or date is a statement, not an objective.

03

Uncontrolled documents. No version, owner, approval or review date. A great policy that is three years stale is still a finding.

04

Thin management reviews. Clause 9.3.2 lists the inputs. Cover each one, including changes in interested party needs, which the 2022 edition added.

05

Weak exclusions. "Not applicable" with no reason invites challenge. Justify every excluded control in one clear sentence.

How it works

Four tiers. Work top down. Do not skip tier 1.

  • Tier 1, must have: required by clauses 4 to 10 for every ISMS. Missing any of these is a likely nonconformity.
  • Tier 2, must have if applicable: required when your Statement of Applicability includes the related Annex A control. Justify any exclusion.
  • Tier 3, best practice: not mandated as documents, but auditors expect the evidence. Having it ready shortens the audit.
  • Tier 4, nice to have: maturity builders that help the ISMS run smoothly and earn trust with the board and customers.

From a team that holds the certificate

XGRC® Software is certified to ISO/IEC 27001:2022. This checklist comes from running an ISMS, not only from reading the standard. Clause and control text is paraphrased, so check exact wording against your licensed copy of ISO/IEC 27001:2022 and ISO/IEC 27002:2022.

From manual to MSXCyber®

Documents that stay current between audits.

Manual approach
  • Policies in shared folders with no review date
  • Statement of Applicability out of step with the risk register
  • Evidence gathered in the weeks before the audit
  • Owners and versions tracked from memory
MSXCyber® approach
  • Controlled documents with owners, versions and review dates
  • Statement of Applicability linked to risks and controls
  • Audit evidence that builds up as work is done
  • A live view of ISMS status for management review
Free resource

ISO 27001:2022 Documentation Checklist

  • Tier 1: the 16 documents clauses 4 to 10 require
  • Tier 2: Annex A documents, when your SoA includes the control
  • Tier 3: the evidence auditors expect to see
  • Tier 4: maturity builders for when the basics are solid
  • The clause or Annex A control for every item
PDF · ISO 27001:2022 + Amd 1:2024 · 60 items · v1.0
Standards and frameworks

Based on the current standard, including the 2024 amendment.

  • ISO 27001:2022
  • Amendment 1:2024
  • ISO 27002:2022
  • ISMS
  • POPIA
Scope of application

Every document an ISMS needs, in order of priority.

  • Mandatory documented information
  • Annex A documents
  • Audit-ready evidence
  • Maturity builders
Related

Explore the connected platform.

All ISO readiness guides →

Solution

MSXCyber®

Information Security Governance

Explore MSXCyber® → ISO Readiness

ISO 27001 Readiness

XGRC® MSXCyber® gives organisations a structured way to assess ISO 27001 readiness, close control gaps, and manage the information security management system all year round, not just in the weeks before an audit.

View use case → Regulatory

POPIA Compliance

XGRC® gives Information Officers a structured way to manage POPIA obligations on one auditable platform, including processing conditions, data subject rights, and security compromise reporting to the Information Regulator.

View use case → Use Case

Internal Audit

XGRC® is internal audit software that lets organisations plan, execute and manage audits in a structured, consistent way. It connects audits to risks, controls and actions on a single platform, giving full visibility across the audit lifecycle.

View use case →
Frequently asked

Common questions.

What documents are mandatory for ISO 27001:2022?

Clauses 4 to 10 require documented information for the ISMS scope, information security policy, risk assessment and treatment processes, Statement of Applicability, risk treatment plan, objectives, evidence of competence, operational planning, risk assessment and treatment results, monitoring results, the internal audit programme and results, management review results, and nonconformities with corrective actions. Annex A adds documents only for the controls your Statement of Applicability includes.

Is an ISMS manual mandatory for ISO 27001?

No. ISO 27001 does not require an ISMS manual. A short handbook can help staff and auditors understand how the ISMS fits together, but no auditor can raise a finding for not having one.

Do I need a written document control procedure?

No. Clause 7.5 requires you to control documented information, including versions, approval, access and retention. Writing a procedure for it is good practice, not a requirement.

Are ISO 27001:2013 certificates still valid?

No. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025. Certificates issued against the 2013 edition are no longer valid.

Does a record in a system count as a document?

Yes. ISO 27001 sets no format for documented information. A controlled record in a system counts as much as a Word file, as long as it is identified, reviewed, approved and protected.

Keep your ISMS live, not in a folder.

Book a demo to see how MSXCyber® brings your Statement of Applicability, risks, controls, documents and audit evidence into one system, with clear owners and review dates.

Book a demo