The relevant Annex A controls that are part of the statement of applicability – which effectively means you need to have all controls listed. Even if an organisation decides that a control is not relevant it should document that e.g.

A description of how it addresses 4.1 to 10.2 of the core requirements, including the risk assessment and treatment which leads onto the selection of the Annex A controls.

ISO 27001 clause 7.5 is broken down as follows: Clause 7.5.1 – General documentation for ISO 27001 ISO certified auditors take great confidence from good housekeeping and maintenance of a well structured information security management system. It is incredibly important that everything related to the ISMS is documented and well maintained, easy to find, if the organisation wants to achieve an independent ISO 27001 certification from a body like UKAS. One of the main requirements for ISO 27001 is therefore to describe your information security management system and then to demonstrate how its intended outcomes are achieved for the organisation. What is Required under Clause 7.5 of ISO 27001:2013?Īnyone familiar with operating to a recognised international ISO IEC standard will know the importance of documentation for the management system.

Top process monitor version 7.5