#iso27001/2022/EN
## 7.5 Documented information

### 7.5.1 General

The organization's information security management system shall include:

a\) documented information required by this document; and

b\) documented information determined by the organization as being necessary for the effectiveness of the information security management system.

NOTE The extent of documented information for an information security management system can differ from one organization to another due to:
	1\) the size of organization and its type of activities, processes, products and services;
	2\) the complexity of processes and their interactions; and
	3\) the competence of persons.

### 7.5.2 Creating and updating

When creating and updating documented information the organization shall ensure appropriate:

a\) identification and description (e.g. a title, date, author, or reference number);

b\) format (e.g. language, software version, graphics) and media (e.g. paper, electronic); and

c\) review and approval for suitability and adequacy.

### 7.5.3 Control of documented information

Documented information required by the information security management system and by this document shall be controlled to ensure:

a\) it is available and suitable for use, where and when it is needed; and

b\) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

For the control of documented information, the organization shall address the following activities, as applicable:

c\) distribution, access, retrieval and use;

d\) storage and preservation, including the preservation of legibility;

e\) control of changes (e.g. version control); and

f\) retention and disposition.

Documented information of external origin, determined by the organization to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled.

NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information, etc.