Beruflich Dokumente
Kultur Dokumente
With the new revision of ISO/IEC 27001 published only a couple of days ago, many people are wondering
what documents are mandatory in this new 2013 revision. Are there more or fewer documents required?
So here is the list – below you will see not only mandatory documents, but also the most commonly used
documents for ISO 27001 implementation.
Non-mandatory documents
There are numerous non-mandatory documents that can be used for ISO 27001 implementation, especially
for the security controls from Annex A. However, I find these non-mandatory documents to be most
commonly used:
Procedure for document control (clause 7.5)
Controls for managing records (clause 7.5)
Procedure for internal audit (clause 9.2)
Procedure for corrective action (clause 10.1)
Bring your own device (BYOD) policy (clause A.6.2.1)
Mobile device and teleworking policy (clause A.6.2.1)
Information classification policy (clauses A.8.2.1, A.8.2.2, and A.8.2.3)
Password policy (clauses A.9.2.1, A.9.2.2, A.9.2.4, A.9.3.1, and A.9.4.3)
Disposal and destruction policy (clauses A.8.3.2 and A.11.2.7)
Procedures for working in secure areas (clause A.11.1.5)
Clear desk and clear screen policy (clause A.11.2.9)
Change management policy (clauses A.12.1.2 and A.14.2.4)
Backup policy (clause A.12.3.1)
Information transfer policy (clauses A.13.2.1, A.13.2.2, and A.13.2.3)
Business impact analysis (clause A.17.1.1)
Exercising and testing plan (clause A.17.1.3)
Maintenance and review plan (clause A.17.1.3)
Business continuity strategy (clause A.17.2.1)
So this is it – what do you think? Is this too much to write? Do these documents cover all aspects of
information security?
Click here to download a white paper Checklist of Mandatory Documentation Required by ISO 27001
(2013 Revision) with more detailed information on the most common ways for structuring and
implementing mandatory documents and records.