EN 
NL 
DE 
For ISO 27001 certification, you need several core documents that make up your Information Security Management System (ISMS). The main mandatory documents are the information security policy, risk assessments, the Statement of Applicability and various incident management and access control procedures. A good document structure and organisation are essential for a successful audit.
Which core documents are mandatory for ISO 27001 certification?
The ISO 27001 standard requires specific core documents that demonstrate that your organisation has implemented a working ISMS. The information security policy forms the basis and describes your organisation-wide approach to information security. This policy must be approved by management and reviewed regularly.
The risk assessments and risk treatment plans are crucial because they demonstrate how your organisation identifies, analyses and controls information security risks. These documents should be current and regularly updated as changes occur in your business processes or IT environment.
The Statement of Applicability (SoA) lists all 93 ISO 27001 security measures from Annex A. For each measure, you must indicate whether it applies to your organisation and why. This document forms the bridge between your risk assessments and the security measures actually implemented.
In addition, several procedures are mandatory, including procedures for incident management, access control, backup and recovery, and vendor management. Documentation on employee awareness and training is also required to demonstrate that your organisation is actively working on information security awareness.
How do you organise your ISMS documentation for a successful audit?
A logical document structure starts with a hierarchical structure where the information security policy is at the top, followed by procedures, work instructions and records. This pyramid structure helps auditors to quickly understand how your ISMS is organised and how different documents are related.
Version control is essential for professional documentation. Each document should have a unique identifier, a version number, an approval date and an owner. Ensure that only the most recent versions are available to employees and that old versions are archived according to a clear system.
Accessibility plays an important role during auditing. Organise your documents in such a way that auditors can easily navigate between related documents. A central document list or index can help. Digital document management systems often offer search functionality that makes the audit more efficient.
Ensure consistent formatting and terminology across all documents. This shows professionalism and makes it easier for auditors to understand the documentation. Use standard templates for different document types and ensure clear links between policies, procedures and records.
What mistakes do organisations often make when preparing ISO 27001 documentation?
A common mistake is drafting incomplete risk assessments that do not cover all business processes and information systems. Organisations often focus only on IT systems and forget about physical security, personnel or external parties. A thorough risk assessment should cover all aspects of information security relevant to your organisation.
Many organisations make their documentation too complex or too general. Documentation that is too complex is difficult to maintain and is often not used by employees. Documentation that is too general does not provide practical guidance for day-to-day operations. Find a balance where documents are specific enough to be useful, but not so detailed that every small change requires a document update.
Missing links between different documents is another common mistake. Information security policies should be consistent with procedures, and procedures should be traceable to identified risks. Auditors check this consistency, and inconsistencies can lead to findings during the audit.
Outdated documentation shows that the ISMS is not being actively maintained. Make sure all documents are regularly reviewed and updated when changes occur in your organisation. Schedule structural reviews of your documentation, e.g. annually or after major organisational changes.
What do auditors expect from your ISO 27001 documentation during certification?
Auditors look for proof that your ISMS is actually implemented in practice. They check not only whether documents exist, but also whether employees know and use them. During interviews, auditors will ask questions about procedures to verify that documentation matches the real situation.
The completeness of documentation is systematically checked against ISO 27001 requirements. Auditors use checklists to verify that all mandatory documents are present and meet the standard requirements. They also assess whether the security measures chosen are adequate for the risks identified.
The quality of documentation is assessed for clarity, timeliness and usability. Auditors value documentation that is clearly written, regularly updated and actually used by employees. They check that documents are logically structured and that clear responsibilities are assigned.
During the audit, you present documentation best by keeping a logical order and navigating quickly between related documents. Prepare by making an overview of where to find specific information. An experienced audit partner like us will help you prepare your documentation for a successful ISO 27001 certification. Do you have questions about the documentation requirements for your specific situation? If so, please contact with us for personal advice.
Frequently Asked Questions
What is the cost of preparing ISO 27001 documentation?
Costs vary widely depending on organisation size and complexity. Small organisations can start from €5,000 for basic documentation, while large organisations can invest €20,000-50,000 including external consultancy and document management systems.
How long does it take to prepare all the mandatory ISO 27001 documents?
For an average organisation, preparing complete ISMS documentation takes 3-6 months. This depends on the availability of internal resources, the complexity of business processes and whether you use external documentation development support.
Why are risk assessments often rejected during ISO 27001 audits?
Risk assessments are rejected because they are incomplete, do not use a clear methodology or do not link risks to specific business processes. Auditors expect all information assets to have been identified and risks quantifiably assessed with consistent criteria.
How often should you update ISO 27001 documentation after certification?
Documentation should be reviewed at least annually, as well as when there are significant changes in business processes, IT systems or organisational structure. Some documents such as risk assessments may require more frequent updates to stay current for surveillance audits.
