7.5.2 Creating and updating
When documented information is created or updated, make sure it is suitably identified and described, is in a suitable format and medium, and is reviewed and approved as fit and adequate.
Source: ISO 22301:2019, 7.5.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO 22301:2019 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Review and approval records showing who approved and when · Document repository
governing documentDocuments that govern the control
- Documents carrying title, date, author or reference and version · Document repository
- Format and media choices suited to how the document is used in a disruption · Policy repository / GRC workspace
First move
Common gaps auditors find
- Approval evidenced by a name in a footer with no date or record
- Format unsuited to use, such as plans available only on the systems a disruption takes out
- Updates issued without re-approval
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet