Section 4
ISMS Documents
Mandatory
ISMS Scope Statement
Defines the boundaries and applicability of the ISMS, including services, locations, departments, processes and dependencies on external parties (clause 4.3).
Information Security Policy
Top-level statement of intent, approved by top management, providing the framework for objectives and demonstrating commitment (clause 5.2).
Risk Assessment Methodology
Documents how risks are identified, analysed and evaluated, including risk and acceptance criteria (clause 6.1.2).
Risk Assessment Report / Risk Register
Records identified risks, owners, impact, likelihood and inherent/residual risk levels.
Risk Treatment Plan
Sets out the chosen treatment options, controls to be implemented, owners, deadlines and resources (clause 6.1.3 e).
Statement of Applicability (SoA)
Lists all Annex A controls with their applicability, justification for inclusion or exclusion and current implementation status (clause 6.1.3 d).
Information Security Objectives
Measurable objectives at relevant functions and levels, with plans to achieve them (clause 6.2).
Evidence of Competence
Records demonstrating that persons performing work affecting information security are competent (clause 7.2).
Monitoring and Measurement Results
Records of the results of monitoring and measurement of the ISMS (clause 9.1).
Internal Audit Programme and Results
Plan, criteria, scope, frequency and methods of internal audits, plus audit reports (clause 9.2).
Management Review Records
Evidence of management review inputs, discussions, decisions and actions (clause 9.3).
Nonconformity and Corrective Action Records
Records of nonconformities, root cause analysis, corrections, corrective actions and their effectiveness (clause 10.2).
Recommended
Asset Inventory
List of information and associated assets with owners (control 5.9).
Acceptable Use Policy
Rules for the acceptable use of information and associated assets (control 5.10).
Access Control Policy
Defines how access is granted, reviewed and revoked, including privileged access (controls 5.15–5.18).
Supplier Security Policy
Requirements for information security in supplier relationships and contracts (controls 5.19–5.22).
Cloud Services Security Policy
Governs acquisition, use and exit of cloud services (control 5.23).
Incident Response Procedure
Defines roles, classification, escalation, communication and lessons learned (controls 5.24–5.27).
Business Continuity Plan and ICT Continuity Plan
Plans to ensure continuity of operations and ICT services during disruption (controls 5.29–5.30).
Legal and Regulatory Requirements Register
Records applicable legal, statutory, regulatory and contractual obligations (control 5.31).
Privacy and PII Protection Policy
Governs the processing and protection of personally identifiable information (control 5.34).
Cryptography Policy
Rules for use and management of cryptographic controls and keys (control 8.24).
Backup Policy and Records
Backup frequency, scope, retention and test results (control 8.13).
Logging and Monitoring Policy
Defines what is logged, retention and review (controls 8.15–8.16).
Vulnerability Management Procedure
How vulnerabilities are identified, evaluated and remediated (control 8.8).
Change Management Procedure
How changes to information systems are requested, assessed, approved and recorded (control 8.32).
Secure Development Policy
Secure coding, testing and environment separation requirements (controls 8.25–8.31).
Awareness and Training Plan
Annual programme for staff awareness and role-based training (control 6.3).