ISO 27001 Mandatory Documents: 2026 Checklist by Clause

Last updated: 20 October 2026

Quick answer: ISO 27001 mandatory documents are the documented information that clauses 4 to 10 of ISO/IEC 27001:2022 explicitly require: the ISMS scope, information security policy, risk assessment and treatment processes, Statement of Applicability, risk treatment plan, objectives, plus records such as competence evidence, risk results, monitoring, internal audits, management reviews and corrective actions.

Few questions come up more often in ISO 27001 projects than “which documents do we actually need?” The standard never publishes a neat list. Instead, requirements for documented information are scattered through the clauses, and auditors check them one by one.

This guide pulls the ISO 27001 mandatory documents together in one checklist, separates documents (which you maintain) from records (which you retain as evidence), and flags the Annex A controls that normally require written rules too. It is written for CISOs and ISMS owners preparing for certification or a surveillance audit.

What are the ISO 27001 mandatory documents?

They are the items of documented information that ISO/IEC 27001:2022 says “shall” be available or retained. Anything beyond that list is optional, although your own ISMS will usually need more documents to work in practice.

The current edition is ISO/IEC 27001:2022, the third edition, published on 25 October 2022. It was updated by Amendment 1:2024 on climate action changes, which asks organisations to consider whether climate change is a relevant issue when determining their context. The amendment does not add a new mandatory document.

Two terms matter:

• Documented information that must be “maintained” is a living document, such as a policy or procedure, that you keep up to date.
• Documented information that must be “retained” is a record, evidence that something happened, such as audit results or management review minutes.

Clause 7.5.1 also requires any other documented information that you decide is necessary for your ISMS to be effective. That gives you flexibility but also means an auditor can ask why a key process has nothing written down.

Which documents does ISO 27001 require by clause?

The following table lists the mandatory documented information in clauses 4 to 10. It is the core of any ISO 27001 mandatory documents checklist.

In practice: You do not need a separate file for each row. Many organisations combine the risk assessment and risk treatment processes in one methodology document, and record risk results in a risk register. What matters is that each requirement can be traced to evidence.

What should each core document contain?

Each core document needs to meet the specific wording of its clause, be approved at the right level and be controlled under clause 7.5.3. Here is what auditors typically look for.

ISMS scope (4.3)

The scope states the boundaries and applicability of the ISMS. It should take account of internal and external issues (4.1), the requirements of interested parties (4.2) and interfaces and dependencies with activities performed by others, such as cloud providers.

Information security policy (5.2)

The top-level policy must be appropriate to the organisation’s purpose, include or provide a framework for objectives, and include commitments to satisfy applicable requirements and to continual improvement. It must be communicated within the organisation and available to interested parties as appropriate.

Risk assessment and treatment processes (6.1.2 and 6.1.3)

Your methodology must define risk acceptance criteria and criteria for performing assessments, and produce consistent, valid and comparable results. If you need guidance, our ISO 27005 risk assessment guide explains a practical approach.

Statement of Applicability (6.1.3 d)

The SoA lists the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A controls. Our guide to the ISO 27001 Statement of Applicability covers it in depth.

Risk treatment plan (6.1.3 e)

The plan sets out how selected controls will be implemented, and risk owners must approve it and accept residual risks (6.1.3 f).

Information security objectives (6.2)

Objectives must be consistent with the policy, measurable where practicable, monitored, communicated and updated. Planning should state what will be done, what resources are needed, who is responsible, when it will be completed and how results will be evaluated.

Which records must you retain as evidence?

Records prove the ISMS is operating. Certification bodies sample them heavily during stage 2 and surveillance audits.

• Competence (7.2): training certificates, CVs, role descriptions and awareness session logs.
• Operational control (8.1): evidence that planned processes run, such as change tickets or access reviews.
• Risk results (8.2 and 8.3): a risk register with dated assessments and treatment status.
• Monitoring (9.1): security metrics, KPI dashboards and review outputs.
• Internal audit (9.2): audit programme, plans, reports and findings.
• Management review (9.3): minutes showing the required inputs were considered and decisions taken.
• Corrective action (10.2): nonconformity log with root cause, actions and effectiveness checks.

Common mistake: Writing excellent policies but keeping thin records. An auditor who sees a strong access control policy will then ask for the last three access reviews. If they do not exist, you have a nonconformity, however good the policy is.

Which Annex A controls usually need documentation?

Annex A controls are not all mandatory, because the SoA decides which apply. But where a control is included, its wording often implies written rules. The most common examples in ISO/IEC 27001:2022 are:

A policy management tool helps here: approval workflows, version history and read-and-accept tracking give you both the document and the evidence that staff saw it.

How do you build the documentation set efficiently?

Build documents in the order the ISMS logic needs them, so each one feeds the next. A typical sequence looks like this:

1. Context and scope: list internal and external issues and interested parties, then write the scope.
2. Policy and objectives: draft the top-level policy and three to five measurable objectives.
3. Risk methodology: define criteria for assessing and accepting risk.
4. Risk assessment: identify and evaluate risks, recording results in a risk register.
5. Risk treatment and SoA: choose controls, justify inclusions and exclusions, and write the treatment plan.
6. Supporting policies and procedures: write only those your SoA and processes need.
7. Operate and record: run the controls, collect evidence and track metrics.
8. Audit and review: complete an internal audit and a management review before certification.

If you already hold other frameworks, such as SOC 2 or NIS2 controls, reuse the evidence rather than duplicating it. Enactia’s AI-powered GRC platform cross-maps controls across frameworks, so one policy or record can support ISO 27001 and other requirements at once. To try it on your own ISMS, start your 14-day free trial.

Does ISO 27001 treat documents the same in the EU, UK and US?

Yes. ISO/IEC 27001 is an international standard, so the mandatory documents are identical wherever you certify. What changes is the local legal context you must capture under clause 4.2 and control 5.31.

Certification bodies should be accredited against ISO/IEC 27006 by a national accreditation body, such as UKAS in the UK or ANAB in the US. The transition deadline from the 2013 edition has passed: according to IAF MD 26, all ISO/IEC 27001:2013 certificates expired or were withdrawn at the end of the transition period on 31 October 2025. Your documentation should therefore reference the 2022 edition and its 93 Annex A controls.

Also note that ISO/IEC 27000:2026, the vocabulary and overview standard, was published in July 2026. It explains concepts and terms but adds no certification requirements.

Key takeaways

• ISO 27001 mandatory documents are spread across clauses 4 to 10; there is no single list in the standard.
• Separate documents you maintain (scope, policy, methodology, SoA, plan, objectives) from records you retain (evidence).
• Annex A controls in your SoA often imply extra documented rules, such as acceptable use and access control.
• Records are where most audit nonconformities appear, so plan evidence collection from day one.
• Only the 2022 edition is valid for certification since 31 October 2025.

Frequently asked questions

How many mandatory documents does ISO 27001 require?
There is no official number, because the standard sets requirements for documented information rather than a list. Counting the explicit clause requirements gives roughly seven documents to maintain and eight or nine types of record to retain. The exact count depends on how you combine items, such as risk methodology and treatment process in one file.

Is the Statement of Applicability mandatory?
Yes. Clause 6.1.3 d) requires a Statement of Applicability containing the necessary controls, justification for their inclusion, whether they are implemented and justification for excluding any Annex A controls. Certification bodies review it closely, and the certificate usually references the SoA version in force at the time of the audit.

Are procedures mandatory in ISO 27001:2022?
Only where the standard or your own ISMS requires them. The 2022 edition has no list of mandatory procedures, but clause 7.5.1 b) requires documentation you determine is necessary, and Annex A controls such as 5.37 documented operating procedures and 5.24 incident management planning normally lead to written procedures.

What is the difference between a document and a record in ISO 27001?
A document, which the standard calls documented information to be maintained, describes how things should be done and changes over time, such as a policy. A record, documented information to be retained, is evidence that something happened, such as an internal audit report or management review minutes, and should not be altered after the fact.

Do we need a separate document for every Annex A control?
No. You can combine related rules into topic-specific policies, for example one access control policy covering several controls. Auditors care that every applicable control is addressed and evidenced, not how many files you have. Fewer, well-maintained documents are usually easier to keep current than dozens of small ones.

Getting your documentation audit-ready

The ISO 27001 mandatory documents are a short list compared with what many templates suggest. Get the core set right, write only the supporting policies your SoA needs, and invest most of your effort in the records that prove the ISMS runs. For a wider view of certification, see our ISO 27001 compliance page.

If you want help organising documents and evidence across ISO 27001 and your other frameworks, contact us or book a demo or start your 14-day free trial.