7.5.3 Documented information: control

Documented information that the standard and the ISMS call for must be controlled so that people can get it, in a usable state, at the place and time they need it, and so that it is suitably protected, for example against loss of confidentiality, misuse or loss of integrity. As applicable, the organization addresses distribution, access, retrieval and use; storage and preservation including keeping it legible; control of changes such as version control; and retention and disposition. External documented information the organization needs for planning and operating the ISMS is identified as appropriate and controlled. A note explains that access can mean permission only to view, or also the right to edit.

Source: ISO/IEC 27001:2022, 7.5.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27001:2022 in the compliance library.

Clauses 4 to 10 are the management-system requirements: none of them can be excluded when an organisation claims conformity. The 93 Annex A controls are a reference set: one may be excluded with a justification in the Statement of Applicability. Certification bodies assess conformity; the evidence lists here are what auditors commonly ask for, not a list the standard prescribes.