# Documented Information Register: [Organization name] ISMS

> Master list of every document and record in the information security
> management system (ISMS): identifier, title, owner, version,
> classification, location, retention and review date. It supports
> ISO/IEC 27001:2022 + Amd 1:2024 clause 7.5 (documented information:
> creating, updating and controlling it, including documents of
> external origin) and Annex A control A.5.33 (protection of records).
> Items the standard explicitly requires are flagged. Replace every
> `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it from the first day of the ISMS project and keep it current;
  it is often the first document a Stage 1 auditor asks for.
- Fill section 3 (mandatory items) first, so nothing the standard
  requires is missing, then add the documents your organisation
  decided it needs (clause 7.5.1 b).
- Main pitfall: a register that lists documents but not records.
  Records (audit reports, review minutes, training evidence) are what
  prove the ISMS operates; give each a retention period and a location.
- Use the Document IDs from the library register so links between
  templates resolve.
- Related templates: `compliance/controlled-document`,
  `compliance/iso-15489-records-schedule`,
  `data/data-retention-deletion-standard`, `isms/isms-manual`,
  `isms/control-evidence-matrix`, `isms/isms-policy-framework`.
-->

## Document control

<!-- Guidance: The register is the control point for every other ISMS document. Name one owner, and version the register when its rules change, not for each new row. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-028 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@records-manager], [@internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clause 7.5; Annex A A.5.33) |
| Next scheduled review | YYYY-MM-DD |
| Document system | [Tool or repository name and path] |
| Numbering scheme | DOC-ISMS-NNN for documents, REC-ISMS-NNN for record series |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First issue before Stage 1 |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and rules](#1-purpose-and-rules)
- [2. Register fields](#2-register-fields)
- [3. Mandatory documented information](#3-mandatory-documented-information)
- [4. Master register](#4-master-register)
- [5. Documents of external origin](#5-documents-of-external-origin)
- [6. Retention and disposal](#6-retention-and-disposal)
- [7. Size tiers](#7-size-tiers)
- [8. Records and evidence](#8-records-and-evidence)
- [9. References](#9-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and rules

<!-- Guidance: State the control rules in a few lines; detailed rules for drafting and approval live in the controlled document template. An auditor checks that identification, review, approval, distribution, access, storage, change control, retention and disposition are all covered. -->

This register is the single list of ISMS documented information. The
rules below apply to every entry:

1. **Identification:** each item has a unique ID, title, owner and
   version (clause 7.5.2).
2. **Review and approval:** documents are approved before issue and
   reviewed at the interval in the register.
3. **Availability and protection:** the current version is available
   to the people who need it, and nobody can lose it, alter it without
   trace or read it without a reason (clause 7.5.3).
4. **Change control:** superseded versions are withdrawn from use and
   kept as records for the retention period.
5. **Records:** records are not edited after completion; corrections
   are new, dated entries (A.5.33).
6. **External origin:** standards, laws, contracts and supplier
   documents used by the ISMS are listed in section 5 and controlled.

## 2. Register fields

<!-- Guidance: Keep the fields the same across documents and records so the register can be filtered. Do not add fields nobody maintains. -->

| Field | Meaning |
|---|---|
| ID | DOC-ISMS-NNN (document) or REC-ISMS-NNN (record series) |
| Title | Short title |
| Type | Policy, procedure, plan, register, record |
| Mandatory | M if explicitly required by ISO/IEC 27001:2022, otherwise blank |
| Clause or control | Requirement it supports |
| Owner | Role accountable for content |
| Version | Current approved version |
| Classification | Public, Internal, Confidential, Restricted (per DOC-ISMS-042) |
| Location | System and path |
| Retention | How long superseded versions or records are kept |
| Review | Interval and next review date |

## 3. Mandatory documented information

<!-- Guidance: These are the items ISO/IEC 27001:2022 explicitly requires, written in our own words. Check each against the official text. Clause 6.3 has no documented-information requirement, but a change record is still useful evidence. -->

| ID | Item | Clause | M | Owner | Version | Location | Review |
|---|---|---|---|---|---|---|---|
| DOC-ISMS-002 | ISMS scope | 4.3 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-001 | Information security policy | 5.2 | M | CISO | [v] | [path] | Annual |
| DOC-ISMS-010 | Risk assessment process (methodology) | 6.1.2 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-010 | Risk treatment process (same methodology) | 6.1.3 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-011 | Statement of Applicability | 6.1.3 d | M | ISMS manager | [v] | [path] | Annual and on change |
| DOC-ISMS-013 | Risk treatment plan (see note) | 6.1.3 e, 8.3 | | ISMS manager | [v] | [path] | Quarterly |
| DOC-ISMS-024 | Information security objectives | 6.2 | M | ISMS manager | [v] | [path] | Quarterly |
| REC-ISMS-001 | Evidence of competence | 7.2 | M | HR | Records | [path] | Continuous |
| DOC-ISMS-028 | Documents determined necessary (this register) | 7.5.1 b | M | ISMS manager | [v] | [path] | Annual |
| REC-ISMS-002 | Operational planning and control information, to the extent necessary | 8.1 | M | Control owners | Records | [path] | Continuous |
| DOC-ISMS-016 | Risk assessment results | 8.2 | M | ISMS manager | [v] | [path] | Each cycle |
| REC-ISMS-003 | Risk treatment results | 8.3 | M | Risk owners | Records | [path] | Each cycle |
| REC-ISMS-004 | Monitoring and measurement results | 9.1 | M | ISMS manager | Records | [path] | Quarterly |
| DOC-ISMS-082 | Audit programme | 9.2.2 | M | Internal audit lead | [v] | [path] | Annual |
| REC-ISMS-005 | Audit results (reports DOC-ISMS-084) | 9.2.2 | M | Internal audit lead | Records | [path] | Each audit |
| REC-ISMS-006 | Management review results (minutes DOC-ISMS-085) | 9.3.3 | M | ISMS manager | Records | [path] | Each review |
| REC-ISMS-007 | Nonconformities, actions taken and results of corrective actions (DOC-ISMS-087) | 10.2 | M | ISMS manager | Records | [path] | Continuous |

Note on the risk treatment plan: clause 6.1.3 expects you to have a
plan that risk owners have signed off, and to keep records of how you
treat risk (6.1.3) and what came of it (8.3). The plan is
not itself named as documented information, so it carries no M flag,
but nearly every auditor asks to see it; keep it controlled.

## 4. Master register

<!-- Guidance: List every other ISMS document. Annex A controls often need documented procedures (A.5.37) or policies (A.5.1); include them when your SoA says they are implemented. Keep the order of the library ID register. -->

| ID | Title | Type | Clause or control | Owner | Version | Classification | Location | Retention of superseded versions | Next review |
|---|---|---|---|---|---|---|---|---|---|
| DOC-ISMS-003 *(Example)* | Context and interested parties | Register | 4.1, 4.2 | ISMS manager | 1.2 | Internal | Document system / ISMS / 01 | 3 years | 2027-09-30 |
| DOC-ISMS-006 *(Example)* | Roles, responsibilities and RACI | Register | 5.3, A.5.2 | CISO | 1.0 | Internal | Document system / ISMS / 01 | 3 years | 2027-09-30 |
| DOC-ISMS-020 *(Example)* | Incident response plan | Plan | A.5.24 to A.5.28 | Security lead | 3.0 | Confidential | Document system / Security | 3 years | 2027-03-31 |
| DOC-ISMS-025 *(Example)* | ISMS change plan | Plan and register | 6.3 | ISMS manager | 1.1 | Internal | Document system / ISMS / 02 | 3 years | 2027-12-31 |
| DOC-ISMS-026 *(Example)* | Competence and training matrix | Register | 7.2, 7.3, A.6.3 | ISMS manager and HR | 1.0 | Confidential | HR system / ISMS | 3 years | 2027-12-31 |
| DOC-ISMS-027 *(Example)* | Communication plan | Plan | 7.4 | ISMS manager | 1.0 | Internal | Document system / ISMS / 02 | 3 years | 2027-12-31 |
| DOC-ISMS-041 *(Example)* | Access control policy | Policy | A.5.15 to A.5.18 | Head of IT | 2.0 | Internal | Document system / Policies | 3 years | 2027-06-30 |
| DOC-ISMS-061 *(Example)* | Backup policy | Policy | A.8.13 | Head of infrastructure | 1.1 | Internal | Document system / Policies | 3 years | 2027-06-30 |
| [DOC-ISMS-NNN] | [title] | [type] | [clause or control] | [owner] | [v] | [class] | [location] | [period] | YYYY-MM-DD |

## 5. Documents of external origin

<!-- Guidance: Clause 7.5.3 asks you to identify and control external documents needed for the ISMS. Record the edition you use and who watches for new editions. Pitfall: an expired copy of a standard or a superseded contract schedule still in use. -->

| ID | Document | Edition or version | Source | Owner | Access | Check for updates |
|---|---|---|---|---|---|---|
| EXT-001 *(Example)* | ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 2024-02-23 | Purchased licence | ISMS manager | ISMS team only, per licence terms | Annual |
| EXT-002 *(Example)* | ISO/IEC 27002:2022 | 2022 | Purchased licence | ISMS manager | ISMS team only | Annual |
| EXT-003 *(Example)* | Cloud provider shared responsibility documentation | Version dated YYYY-MM-DD | Provider website | Head of infrastructure | Internal | Quarterly |
| EXT-004 *(Example)* | Customer master agreement security schedule | Signed version | Contract system | Legal counsel | Restricted | On renewal |
| EXT-005 *(Example)* | GDPR consolidated text | Official journal version | EU official site | Privacy lead | Public | Annual (via DOC-ISMS-014) |

## 6. Retention and disposal

<!-- Guidance: Set retention by record series, not by file. Legal and contractual periods come from the legal register; the values below are examples, not legal requirements. Many organisations keep ISMS records at least for one three-year certification cycle so auditors can sample them. -->

| Record series | Retention *(Example)* | Trigger | Disposal method | Approver |
|---|---|---|---|---|
| Superseded policies and procedures | 3 years | Date superseded | Delete from document system, keep register entry | ISMS manager |
| Audit reports, management review minutes, corrective actions | 6 years (two certification cycles) | Date of closure | Secure deletion | ISMS manager |
| Risk register snapshots | 3 years | Date of next snapshot | Secure deletion | ISMS manager |
| Competence and training evidence | Employment plus period in HR policy | End of employment | Per HR retention policy | HR lead |
| Incident records | Per legal register, at least [5] years | Incident closure | Secure deletion, legal hold check first | Legal counsel |
| Logs used as evidence | Per security logging standard | Log date | Automated expiry | Security lead |

Before disposal, check for a legal hold, an open audit finding or an
ongoing incident. Record each disposal batch (series, date range,
method, approver) so disposal is itself evidenced. For detailed
schedules use `compliance/iso-15489-records-schedule` and
`data/data-retention-deletion-standard`.

## 7. Size tiers

<!-- Guidance: The register grows with the organisation, but the mandatory section stays the same. These are the library's working tiers. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Typical size *(Example)* | 30 to 45 entries | 70 to 120 entries | 150 or more, with site-level documents |
| Tool | Shared drive or wiki with version history, this table as the index | Document management system with approval workflow | Integrated management system platform shared with ISO 9001 and ISO 22301 |
| Owner | Part-time ISMS manager (0.5 FTE) | ISMS manager with a document controller | Group document control function, site coordinators |
| External documents | Standards, cloud provider terms, key customer contracts | Plus health sector rules and hospital contract schedules | Plus local laws in 4 countries and OT supplier documents |

## 8. Records and evidence

<!-- Guidance: The register itself is evidence for clause 7.5. Show that it is reviewed and that disposal is recorded. -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| This register with version history | Documented information is identified and controlled (7.5) | ISMS manager | Document system | Current plus [3] years of history |
| Approval records per document | Review and approval before issue (7.5.2) | Document owners | Document system workflow | Life of document plus [3] years |
| Disposal log | Retention and disposition applied (7.5.3) | ISMS manager | [path] | [6] years |
| Access permission reviews of the document system | Protection of documented information (7.5.3, A.5.33) | Head of IT | Access review records | [3] years |

Map these records to clause 7.5 and control A.5.33 in the control
evidence matrix (`isms/control-evidence-matrix`, DOC-ISMS-033).

## 9. References

<!-- Guidance: Cite the editions you used and check for new editions at each annual review of this register. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clause 7.5 and the clauses listed in section 3; Annex A A.5.33 (cited only) |
| ISO/IEC 27002:2022 | Current | Guidance for A.5.33 and A.5.37 |
| ISO 15489-1:2016 | Cite without link; check the current edition | Records management concepts |

Related templates: Controlled document (`compliance/controlled-document`),
Records retention schedule (`compliance/iso-15489-records-schedule`),
Data retention and deletion standard
(`data/data-retention-deletion-standard`), ISMS manual
(`isms/isms-manual`, DOC-ISMS-008), Policy framework
(`isms/isms-policy-framework`, DOC-ISMS-005), Control evidence matrix
(`isms/control-evidence-matrix`, DOC-ISMS-033), Legal register
(`compliance/legal-register`, DOC-ISMS-014).

Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html,
Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022
https://www.iso.org/standard/75652.html.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clause 7.5,
the documented information requirements of clauses 4.3 to 10.2, and
Annex A control A.5.33). The list of mandatory items is written in
original words; no ISO/IEC text is reproduced, and you need the
official standard to confirm each requirement. Retention periods are
examples, not legal requirements. Check the current editions before
use. Quillmere organisations and all figures are fictional examples.
Template licence: MIT.