ISO 27001 Document Control: The Complete 2026 Guide

ISO 27001 document control is the part of the standard most teams think they have covered and most auditors find a gap in, because clause 7.5 is not asking you to own a document control procedure — it is asking you to prove that every document and record in the ISMS is findable, current, approved, protected and disposed of on a rule you decided in advance. Those are two different things, and the second one is what gets tested.

This ISO 27001 document control guide covers what clause 7.5 of ISO/IEC 27001:2022 actually requires, the evidence that satisfies each part of it, the register that carries it, and the overlap with Annex A that makes document control in an ISMS different from document control in any other management system.

What ISO 27001 Document Control Actually Requires

Clause 7.5 is split into three sub-clauses, and each one does a distinct job:

• 7.5.1 General — the ISMS has to include the documented information the standard requires, plus whatever else your organization has determined is necessary for the ISMS to be effective. The second half is the part you choose, and once you have chosen it, it is in scope.
• 7.5.2 Creating and updating — new or changed documented information must carry appropriate identification and description (title, date, author, reference number), be in a suitable format and medium, and be reviewed and approved for suitability and adequacy.
• 7.5.3 Control of documented information — it must be available and suitable for use where and when it is needed, and adequately protected. The standard names what it is protected from: loss of confidentiality, improper use, and loss of integrity.

Note what is absent. Clause 7.5 never uses the word “procedure.” No document control procedure is required anywhere in ISO 27001 as a named document, and it is not on the list of mandatory documents ISO 27001 requires. Most organizations write one anyway, which is sensible — it is the cheapest way to show an auditor the rules in one place — but write it because it makes the evidence easy, not because the clause demands it.

Clause 7.5.3: The Activities You Have to Address

ISO 27001 document control lives mostly in 7.5.3, which lists the activities that have to be addressed, as applicable. “As applicable” is a real qualifier — a two-person startup running everything in one controlled workspace will satisfy several of these with the same mechanism. What is not optional is being able to say which mechanism answers which activity.

Clause 7.5.3 activity	What it means in practice	Evidence an auditor accepts
Distribution, access, retrieval and use	The right people can find the current version without asking anyone	Permission groups on the document library; a link in the policy acknowledgement email that resolves to the live file
Storage and preservation, including legibility	Files stay readable and openable over the whole retention period	Approved formats list; PDF/A or native Office for anything retained beyond a few years; evidence that archived records still open
Control of changes, including version control	Every change is identifiable and the previous state is recoverable	Version history in the platform, or a version/revision field plus a change log table inside each document
Retention and disposition	A defined period, then a defined end — kept or securely destroyed	Retention schedule naming each class of record, its period, its legal basis, and the disposal method
Adequate protection	Confidentiality, improper use and integrity are all covered	Read-only by default for published policies; restricted access on risk and audit records; backup coverage of the document store

Retention and disposition is where the most findings land, and the reason is structural: organizations set retention periods and then never execute the disposition half. A retention schedule that says “7 years” with a folder containing records from 2011 is a nonconformity against your own rule, which is worse than having no rule.

Why ISO 27001 Document Control Is Also a Security Control

This is the difference between ISO 27001 document control and the same clause in ISO 9001 or ISO 45001, and it is the part generic document control guidance misses. In an ISMS, the documents are themselves information assets, so clause 7.5 interacts with Annex A — the 93 controls in four themes (37 organizational, 8 people, 14 physical, 34 technological) — in a way that no quality or safety system has to deal with.

Four Annex A controls sit directly on top of clause 7.5:

• A.5.12 Classification of information — your ISMS documents need a classification, and so do the records they generate. A risk register and an internal audit report are not “Internal” by default; both routinely contain exactly the material an attacker would want.
• A.5.13 Labelling of information — the classification has to be visible. In document terms that is a classification field in the header or footer of every controlled document, matching the scheme you defined under A.5.12.
• A.5.33 Protection of records — records must be protected from loss, destruction, falsification, unauthorized access and unauthorized release. That is a stronger bar than clause 7.5.3’s “adequately protected,” and it is the control your retention schedule and secure disposal method actually answer.
• A.5.37 Documented operating procedures — operating procedures for information processing facilities must be documented and available to the people who need them. If you applied this control in your Statement of Applicability, those procedures become controlled documents, and their currency is auditable.

The practical consequence is that one register has to carry both sets of requirements at once. A register tracking owner, version and approval date satisfies clause 7.5 and fails A.5.12 and A.5.13, because nothing in it records how sensitive each document is or who may open it. Two more columns fix it.

The Document Register That Satisfies Both

You do not need a document management platform to pass an ISO 27001 document control sample. You need one register, maintained, that answers every question an auditor can ask from the clause. These ten columns do that:

Column	Why it is there
Reference / document ID	7.5.2 identification
Title	7.5.2 description
Current version	7.5.3 control of changes
Issue / approval date	7.5.2 review and approval
Approver (role, not name)	7.5.2 approval authority survives staff turnover
Owner	Who is accountable for keeping it current
Next review date	Makes the review cycle provable instead of asserted
Classification	A.5.12, and it drives the label under A.5.13
Retention period and disposal method	7.5.3 retention and disposition; A.5.33
Internal or external origin	The sub-clause most registers have no column for

Keep it in one place and keep the review dates honest. An auditor who finds three documents past their own next-review date has found a systemic finding rather than three isolated ones, because the register is the control and the register was not operated.

Documented Information of External Origin

Clause 7.5.3 closes with a requirement that is quietly skipped in most implementations: documented information of external origin that the organization has determined is necessary for the planning and operation of the ISMS must be identified as appropriate and controlled.

In an information security management system that list is longer than people expect. The standard itself. Your certification body’s scheme rules. Supplier contracts and their security schedules. Customer security requirements you have accepted. Regulatory texts and sector guidance you cite in your policies. Cloud provider shared-responsibility documents your control design relies on.

Controlling them does not mean owning their content — you cannot version a regulator’s document. It means knowing which external document you are relying on, which edition, where the authoritative copy lives, and who checks whether it has been superseded. A separate tab on the document register with four columns (title, source, edition or date, last verified) is enough, and it is the fastest ISO 27001 document control finding to close if you get written up for it.

This matters more after an edition change than at any other time. Organizations that had not identified the standard as a controlled external document were the ones still citing ISO/IEC 27001:2013 clause numbers in their policies after the transition period closed on 31 October 2025. You can confirm the current edition and its amendments on the official ISO/IEC 27001 standard page.

The Four Documents Where Version Control Really Matters

ISO 27001 document control applies to everything in the ISMS, but four documents carry disproportionate audit risk because they are dated artifacts that reference each other:

• The Statement of Applicability, mandatory under clause 6.1.3. It records a decision about all 93 Annex A controls at a point in time. If the SoA version predates your latest risk assessment, the auditor has a legitimate question about whether the decisions were revisited.
• The risk assessment results and risk register. These are records, not documents, and the distinction has consequences — records get retention rules and should not be edited in place once accepted. A risk register overwritten in place has no history, which makes the clause 8.2 requirement to retain results of risk assessments hard to evidence.
• The risk treatment plan. It has to be traceable to the SoA version it was derived from.
• The information security policy and its supporting topic-specific policies. These are the documents with the widest distribution, so they are where “available where and when needed” is genuinely tested — by asking an employee to produce the current one.

The cheapest way to keep these four straight is a reference to the source version inside each derived document: the risk treatment plan names the SoA version, the SoA names the risk assessment date. It takes one line each and it answers the hardest traceability question in the audit.

Six ISO 27001 Document Control Findings Auditors Write

1. Documents past their own review date. You set the frequency; failing to meet it is a nonconformity against your own system, not a judgement call.
2. Two live copies. The approved version in the document library and a working copy on a shared drive that staff actually use. This fails “suitable for use where and when needed” in the most direct way possible.
3. No retention schedule, or one that is never executed. Covered above, and the most common of the six.
4. Approval recorded as a name with no date, or a date with no approver. 7.5.2 wants both, and a signature block left blank in the template is the usual cause.
5. No classification or label on ISMS documents. Fails A.5.12 and A.5.13 even though clause 7.5 looks satisfied.
6. External documents not identified at all. Often no register exists, so there is nothing to sample.

None of these need tooling to fix. All six are register discipline, which is why ISO 27001 document control is one of the few areas where a small organization can genuinely outperform a large one.

Frequently Asked Questions

Does ISO 27001 document control require a written procedure? No. Clause 7.5 does not use the word procedure and no such document appears in the standard’s list of required documented information. Writing one is optional and usually worth it, because it puts your versioning, approval, retention and classification rules in one place an auditor can read in five minutes.

What is the difference between a document and a record under ISO 27001 document control? The 2022 edition uses “documented information” for both, so the standard draws no formal line. The practical distinction still matters: documents state intent and get revised, records state what happened and should not be. Apply version control to the first and retention plus integrity protection to the second.

Can we run ISO 27001 document control in SharePoint or Google Drive? Yes, and most certified organizations do. Native version history satisfies control of changes, and permission groups satisfy distribution and access. What these platforms do not give you is a review-date field, a retention trigger or a classification column, which is why the register still exists alongside them.

How long do we have to keep ISMS records? The standard sets no period. You set it, document it, justify it against legal, contractual and business needs, and then follow it. Three certification cycles — nine years — is a common choice for audit and management review records because it keeps a full history available; one cycle is defensible if storage or privacy obligations push the other way.

Do draft documents need to be controlled? Only to the extent that drafts must not be mistakable for approved versions. A clear draft watermark or a separate drafts location is enough. The failure mode is an unapproved draft sitting in the published library.

Where to Start

Build the register first. ISO 27001 document control is a register problem before it is a writing problem, so open a spreadsheet, put the ten columns across the top, and fill a row for every ISMS document and record class you already have — the gaps will identify themselves, usually as blank classification and retention cells. Then write the one-page procedure that states the rules the register implements. Doing it in that order takes an afternoon; doing it the other way around produces a procedure nobody can evidence.

For how clause 7.5 fits alongside the rest of the support requirements, see our guide to ISO clause 7: support, and for the wider certification picture start with ISO 27001 certification. The register also feeds the measurement side of the system, covered in ISO 27001 monitoring and measurement.

If you would rather start from finished documents, the document control procedure, document register, retention schedule and classification policy that clause 7.5 needs are already written in the ISO 27001 Toolkit — 165 templates covering the full management system for $99, ready to tailor to your scope.