ISMS Documented Information Register Template (ISO/IEC 27001 7.5)
Master list of ISMS documents and records: mandatory items flagged, owner, version, classification, location, retention, external documents, disposal
使用方法: Use it from the first day of the ISMS project and keep it current for Stage 1. Fill the mandatory items section first, then add the documents your organisation decided it needs. The main pitfall is listing documents but not records, with no retention or location.
预览
Documented Information Register: [Organization name] ISMS
Master list of every document and record in the information security management system (ISMS): identifier, title, owner, version, classification, location, retention and review date. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 7.5 (documented information: creating, updating and controlling it, including documents of external origin) and Annex A control A.5.33 (protection of records). Items the standard explicitly requires are flagged. Replace every
[bracketed]value and every row marked Example.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-028 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@records-manager], [@internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clause 7.5; Annex A A.5.33) |
| Next scheduled review | YYYY-MM-DD |
| Document system | [Tool or repository name and path] |
| Numbering scheme | DOC-ISMS-NNN for documents, REC-ISMS-NNN for record series |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 (Example) | YYYY-MM-DD | [@isms-manager] | First issue before Stage 1 |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |
Contents
1. Purpose and rules
This register is the single list of ISMS documented information. The rules below apply to every entry:
- Identification: each item has a unique ID, title, owner and version (clause 7.5.2).
- Review and approval: documents are approved before issue and reviewed at the interval in the register.
- Availability and protection: the current version is available to the people who need it, and nobody can lose it, alter it without trace or read it without a reason (clause 7.5.3).
- Change control: superseded versions are withdrawn from use and kept as records for the retention period.
- Records: records are not edited after completion; corrections are new, dated entries (A.5.33).
- External origin: standards, laws, contracts and supplier documents used by the ISMS are listed in section 5 and controlled.
2. Register fields
| Field | Meaning |
|---|---|
| ID | DOC-ISMS-NNN (document) or REC-ISMS-NNN (record series) |
| Title | Short title |
| Type | Policy, procedure, plan, register, record |
| Mandatory | M if explicitly required by ISO/IEC 27001:2022, otherwise blank |
| Clause or control | Requirement it supports |
| Owner | Role accountable for content |
| Version | Current approved version |
| Classification | Public, Internal, Confidential, Restricted (per DOC-ISMS-042) |
| Location | System and path |
| Retention | How long superseded versions or records are kept |
| Review | Interval and next review date |
3. Mandatory documented information
| ID | Item | Clause | M | Owner | Version | Location | Review |
|---|---|---|---|---|---|---|---|
| DOC-ISMS-002 | ISMS scope | 4.3 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-001 | Information security policy | 5.2 | M | CISO | [v] | [path] | Annual |
| DOC-ISMS-010 | Risk assessment process (methodology) | 6.1.2 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-010 | Risk treatment process (same methodology) | 6.1.3 | M | ISMS manager | [v] | [path] | Annual |
| DOC-ISMS-011 | Statement of Applicability | 6.1.3 d | M | ISMS manager | [v] | [path] | Annual and on change |
| DOC-ISMS-013 | Risk treatment plan (see note) | 6.1.3 e, 8.3 | ISMS manager | [v] | [path] | Quarterly | |
| DOC-ISMS-024 | Information security objectives | 6.2 | M | ISMS manager | [v] | [path] | Quarterly |
| REC-ISMS-001 | Evidence of competence | 7.2 | M | HR | Records | [path] | Continuous |
| DOC-ISMS-028 | Documents determined necessary (this register) | 7.5.1 b | M | ISMS manager | [v] | [path] | Annual |
| REC-ISMS-002 | Operational planning and control information, to the extent necessary | 8.1 | M | Control owners | Records | [path] | Continuous |
| DOC-ISMS-016 | Risk assessment results | 8.2 | M | ISMS manager | [v] | [path] | Each cycle |
| REC-ISMS-003 | Risk treatment results | 8.3 | M | Risk owners | Records | [path] | Each cycle |
| REC-ISMS-004 | Monitoring and measurement results | 9.1 | M | ISMS manager | Records | [path] | Quarterly |
| DOC-ISMS-082 | Audit programme | 9.2.2 | M | Internal audit lead | [v] | [path] | Annual |
| REC-ISMS-005 | Audit results (reports DOC-ISMS-084) | 9.2.2 | M | Internal audit lead | Records | [path] | Each audit |
| REC-ISMS-006 | Management review results (minutes DOC-ISMS-085) | 9.3.3 | M | ISMS manager | Records | [path] | Each review |
| REC-ISMS-007 | Nonconformities, actions taken and results of corrective actions (DOC-ISMS-087) | 10.2 | M | ISMS manager | Records | [path] | Continuous |
Note on the risk treatment plan: clause 6.1.3 expects you to have a plan that risk owners have signed off, and to keep records of how you treat risk (6.1.3) and what came of it (8.3). The plan is not itself named as documented information, so it carries no M flag, but nearly every auditor asks to see it; keep it controlled.
4. Master register
| ID | Title | Type | Clause or control | Owner | Version | Classification | Location | Retention of superseded versions | Next review |
|---|---|---|---|---|---|---|---|---|---|
| DOC-ISMS-003 (Example) | Context and interested parties | Register | 4.1, 4.2 | ISMS manager | 1.2 | Internal | Document system / ISMS / 01 | 3 years | 2027-09-30 |
| DOC-ISMS-006 (Example) | Roles, responsibilities and RACI | Register | 5.3, A.5.2 | CISO | 1.0 | Internal | Document system / ISMS / 01 | 3 years | 2027-09-30 |
| DOC-ISMS-020 (Example) | Incident response plan | Plan | A.5.24 to A.5.28 | Security lead | 3.0 | Confidential | Document system / Security | 3 years | 2027-03-31 |
| DOC-ISMS-025 (Example) | ISMS change plan | Plan and register | 6.3 | ISMS manager | 1.1 | Internal | Document system / ISMS / 02 | 3 years | 2027-12-31 |
| DOC-ISMS-026 (Example) | Competence and training matrix | Register | 7.2, 7.3, A.6.3 | ISMS manager and HR | 1.0 | Confidential | HR system / ISMS | 3 years | 2027-12-31 |
| DOC-ISMS-027 (Example) | Communication plan | Plan | 7.4 | ISMS manager | 1.0 | Internal | Document system / ISMS / 02 | 3 years | 2027-12-31 |
| DOC-ISMS-041 (Example) | Access control policy | Policy | A.5.15 to A.5.18 | Head of IT | 2.0 | Internal | Document system / Policies | 3 years | 2027-06-30 |
| DOC-ISMS-061 (Example) | Backup policy | Policy | A.8.13 | Head of infrastructure | 1.1 | Internal | Document system / Policies | 3 years | 2027-06-30 |
| [DOC-ISMS-NNN] | [title] | [type] | [clause or control] | [owner] | [v] | [class] | [location] | [period] | YYYY-MM-DD |
5. Documents of external origin
| ID | Document | Edition or version | Source | Owner | Access | Check for updates |
|---|---|---|---|---|---|---|
| EXT-001 (Example) | ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 2024-02-23 | Purchased licence | ISMS manager | ISMS team only, per licence terms | Annual |
| EXT-002 (Example) | ISO/IEC 27002:2022 | 2022 | Purchased licence | ISMS manager | ISMS team only | Annual |
| EXT-003 (Example) | Cloud provider shared responsibility documentation | Version dated YYYY-MM-DD | Provider website | Head of infrastructure | Internal | Quarterly |
| EXT-004 (Example) | Customer master agreement security schedule | Signed version | Contract system | Legal counsel | Restricted | On renewal |
| EXT-005 (Example) | GDPR consolidated text | Official journal version | EU official site | Privacy lead | Public | Annual (via DOC-ISMS-014) |
6. Retention and disposal
| Record series | Retention (Example) | Trigger | Disposal method | Approver |
|---|---|---|---|---|
| Superseded policies and procedures | 3 years | Date superseded | Delete from document system, keep register entry | ISMS manager |
| Audit reports, management review minutes, corrective actions | 6 years (two certification cycles) | Date of closure | Secure deletion | ISMS manager |
| Risk register snapshots | 3 years | Date of next snapshot | Secure deletion | ISMS manager |
| Competence and training evidence | Employment plus period in HR policy | End of employment | Per HR retention policy | HR lead |
| Incident records | Per legal register, at least [5] years | Incident closure | Secure deletion, legal hold check first | Legal counsel |
| Logs used as evidence | Per security logging standard | Log date | Automated expiry | Security lead |
Before disposal, check for a legal hold, an open audit finding or an
ongoing incident. Record each disposal batch (series, date range,
method, approver) so disposal is itself evidenced. For detailed
schedules use compliance/iso-15489-records-schedule and
data/data-retention-deletion-standard.
7. Size tiers
| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Typical size (Example) | 30 to 45 entries | 70 to 120 entries | 150 or more, with site-level documents |
| Tool | Shared drive or wiki with version history, this table as the index | Document management system with approval workflow | Integrated management system platform shared with ISO 9001 and ISO 22301 |
| Owner | Part-time ISMS manager (0.5 FTE) | ISMS manager with a document controller | Group document control function, site coordinators |
| External documents | Standards, cloud provider terms, key customer contracts | Plus health sector rules and hospital contract schedules | Plus local laws in 4 countries and OT supplier documents |
8. Records and evidence
| Record | Proves | Owner | Location | Retention (Example) |
|---|---|---|---|---|
| This register with version history | Documented information is identified and controlled (7.5) | ISMS manager | Document system | Current plus [3] years of history |
| Approval records per document | Review and approval before issue (7.5.2) | Document owners | Document system workflow | Life of document plus [3] years |
| Disposal log | Retention and disposition applied (7.5.3) | ISMS manager | [path] | [6] years |
| Access permission reviews of the document system | Protection of documented information (7.5.3, A.5.33) | Head of IT | Access review records | [3] years |
Map these records to clause 7.5 and control A.5.33 in the control
evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033).
9. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clause 7.5 and the clauses listed in section 3; Annex A A.5.33 (cited only) |
| ISO/IEC 27002:2022 | Current | Guidance for A.5.33 and A.5.37 |
| ISO 15489-1:2016 | Cite without link; check the current edition | Records management concepts |
Related templates: Controlled document (compliance/controlled-document),
Records retention schedule (compliance/iso-15489-records-schedule),
Data retention and deletion standard
(data/data-retention-deletion-standard), ISMS manual
(isms/isms-manual, DOC-ISMS-008), Policy framework
(isms/isms-policy-framework, DOC-ISMS-005), Control evidence matrix
(isms/control-evidence-matrix, DOC-ISMS-033), Legal register
(compliance/legal-register, DOC-ISMS-014).
Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html, Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022 https://www.iso.org/standard/75652.html.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clause 7.5, the documented information requirements of clauses 4.3 to 10.2, and Annex A control A.5.33). The list of mandatory items is written in original words; no ISO/IEC text is reproduced, and you need the official standard to confirm each requirement. Retention periods are examples, not legal requirements. Check the current editions before use. Quillmere organisations and all figures are fictional examples. Template licence: MIT.
相关模板
Audit Findings Register Template (ISO/IEC 27001 9.2 and 10.2)
One register for internal, certification body, customer and assessment findings: ID convention, grades, fields, status workflow, links to CAPA, reporting
ISMS 与 ISO/IEC 27001Continual Improvement Register Template (ISO/IEC 27001 clause 10.1)
Improvement opportunities from all sources, triage against nonconformities, benefit and ease scoring, decision, owner, status, benefit review, reporting
ISMS 与 ISO/IEC 27001Cryptographic Key and Certificate Register Template (ISO/IEC 27001 A.8.24)
Key and certificate inventory: field definitions, lifecycle states, register rows, expiry alerts, algorithm checks, post-quantum exposure, change log