List of ISO 27001 Mandatory Documents

The hard part of ISO 27001 documentation is not writing the documents. It is knowing which ones you actually need.

Some are required by the standard, no matter what. Others are required only if you selected the matching Annex A control in your Statement of Applicability, and treating those as mandatory is a common way teams create work they do not need.

This guide separates the two: the documents ISO 27001:2022 always requires, the records auditors expect to see, and the Annex A documents that depend on your control selection.

What are ISO 27001 mandatory documents?

ISO 27001 mandatory documents are the documented information the standard requires you to create and maintain to show your ISMS is designed, implemented, and operating effectively. In ISO 27001:2022 that documented information comes from two places: the management system clauses (4 to 10), which name or clearly imply specific documents and records, and Annex A, which calls for documents only where the related control applies to you.

List of ISO 27001 mandatory documents

Some ISO 27001 documents are always required. Others are required only if you selected the matching Annex A control. The tables below split them into what you always need and what depends on your control choices.

Table A: Always required (Clauses 4 to 10)

Document	Clause	What it covers
Scope of the ISMS	4.3	What the ISMS covers: which entities, locations, products, systems, and data are in and out of scope.
Information security policy	5.2	Leadership’s security commitments and the framework for setting objectives.
Information security objectives	6.2	The measurable security goals for the period, documented and communicated.
Risk assessment process	6.1.2	How you identify, score, and prioritise information security risks.
Risk treatment process	6.1.3	How you decide to treat each risk: mitigate, transfer, accept, or avoid.
Statement of Applicability	6.1.3	The controls you selected or excluded, with justification, status, and owners.
Risk treatment plan	6.1.3, 8.3	The chosen treatment for each risk, with actions, owners, and timelines.
Result of risk assessment and risk treatment	8.2, 8.3	The assessed risks and the outcomes of treating them.

Table B: Required records (Clauses 7 to 10)

Record	Clause	What it covers
Evidence of competence (training, skills, experience, qualifications)	7.2	Records showing the people in security roles are trained and qualified.
Monitoring and measurement results	9.1	What you measured about ISMS performance and what it showed.
Internal audit programme	9.2	The plan and schedule for internal ISMS audits.
Results of internal audits	9.2	Findings, follow-up actions, and their status.
Results of the management review	9.3	Decisions and actions from leadership’s review of the ISMS.
Results of corrective actions	10.2	Nonconformities raised and the actions taken to fix them.
Logs of user activities, exceptions, and security events	A.8.15	The activity and event logs used for investigation and root cause analysis.

Table C: Required where the matching Annex A control applies

Document	Annex A control	What it covers
Inventory of assets	A.5.9	A record of the information, systems, and other assets you need to protect.
Acceptable use of assets	A.5.10	The rules for how people may use company systems and data.
Access control rules and supporting evidence	A.5.15	How access is granted, reviewed, changed, and revoked, plus review records.
Statutory, regulatory, and contractual requirements	A.5.31	The legal and contractual obligations you must meet, mapped to controls and owners.
Incident management procedure	A.5.24	How incidents are identified, escalated, contained, and reviewed afterwards.
Operating procedures for IT management	A.5.37	Reference procedures for running IT operations such as monitoring and backups.
Definition of security roles and responsibilities	5.3, A.5.2	Who owns which security duties across implementation, monitoring, and administration.
Definition of security configurations	A.8.9	The approved baseline for systems, cloud services, endpoints, and networks, and how drift is corrected.
Secure system engineering principles	A.8.27	The principles for designing and building secure systems, including secure SDLC and testing gates.
Business continuity procedures	A.5.29, A.5.30	How you keep information available and recover during disruption, including RTO and RPO for critical systems.

Some implementation tips for maintaining documents for ISO 27001:

• Establish protocols for managing documents throughout their lifecycle
• Clearly communicate ownership and access controls
• Have a document audit when running internal audits and update as per requirements
• Define document retention and disposal procedures
• Make use of standardized templates for keeping things easy and consistent
• Present information in a clear and understandable manner. Use process flowcharts, organizational structure diagrams, and other visual aids to promote clarity.

Non-mandatory documents

These are not separately mandated, but many organisations keep them because they support selected Annex A controls and give auditors clear evidence. Which ones you need depends on your risk profile and the controls in your SoA.

Non-Mandatory documents	ISO 27001 Clause/Annex
Procedure for document control	Clause 7.5, Annex A 5.33
Controls for managing records	Clause 7.5, Annex A 5.33
Procedure for internal audit	Clause 9.2
Procedure for corrective action	Clause 10.2
Bring your own device (BYOD) policy	Annex A 7.8, 8.1
Mobile device and teleworking policy	Annex A 6.7, 7.8, 7.9, 8.1
Information classification policy	Annex A 5.10, 5.12, 5.13
Password policy	Annex A 5.16, 5.17, 8.5
Disposal and destruction policy	Annex A 7.10, 7.14, 8.10
Procedures for working in secure areas	Annex A 7.4, 7.6
Clear desk and clear screen policy	Annex A 7.7
Change management policy	Annex A 8.32
Backup policy	Annex A 8.13
Information transfer policy	Annex A 5.14
Supplier security policy	Annex A.5.19, A.5.21, A.5.22, A.5.23
Encryption policy	Annex A 8.24

To make your security configuration documentation audit-ready, include:

• The approved baseline configuration for key systems, cloud services, endpoints, and network components
• The source used to define the baseline, such as vendor hardening guidance, CIS benchmarks, or an internal standard
• Evidence that the configuration was applied, such as screenshots, exported settings, configuration scans, or automated control results
• Timestamps showing when the configuration was last reviewed or tested
• Exception records for systems that cannot follow the baseline, including owner, risk acceptance, and review date
• Change records showing how unauthorized or drifted configurations are detected and corrected

Consequences of missing ISO 27001 mandatory documents

In an  ISO 27001 certification audit, the auditor records any major non-conformities, minor non-conformities, and opportunities for improvement. Not having ISO 27001 mandatory documents is a major non-conformity.

Usually non-conformities hinder the certification process and will require you to revisit the exact documentation obligations and submit the missing pieces to the auditor, before the certification can be granted. This can extend your timelines by 1-4 weeks depending on the time you take to gather/recreate the evidence and catalogue it before submitting it to the auditor for review.

Missing documentation can also mask weak spots in risk management, access control, incident response, or supplier oversight. ISO 27001 does not impose fines itself, but those gaps are exactly what an auditor probes, so getting the documentation right the first time keeps certification on schedule.

Reach ISO 27001 audit-ready faster with Sprinto

Sprinto is an AI-powered autonomous trust platform that runs compliance for you rather than just tracking it.

On the documentation side, it gives you policies and templates already mapped to ISO 27001 controls, so your mandatory documents start close to done instead of from a blank page.

On the harder side, keeping the underlying controls working, Sprinto connects to your cloud, identity, and security tools and checks them continuously in the background. It tracks live configurations, verifies each control, and collects audit-ready evidence automatically. Your documentation stays backed by proof that reflects the real state of your environment, so the audit becomes a matter of producing what already exists rather than rebuilding a year of it.

Read how Axslogic did 30% faster evidence collection in a single-view compliance management provided by Sprinto. Talk to our experts today and get ISO 27001 compliant 10x faster.