### 7.5.3 Control of documented information

Documented information required by the information security management system and by this document shall be controlled to ensure:

a\) it is available and suitable for use, where and when it is needed; and

b\) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

For the control of documented information, the organization shall address the following activities, as applicable:

c\) distribution, access, retrieval and use;

d\) storage and preservation, including the preservation of legibility;

e\) control of changes (e.g. version control); and

f\) retention and disposition.

Documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled.

NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information, etc.