This checklist lists the documents and records ISO 27001:2022 requires, with the clause or Annex A control each one comes from and space for the evidence.
Prepared using the F-Q2 Audit Checklist form template.
The file is supplied in fully editable MS Word format and can be easily customised, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Checklist number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested audit checklists. No junk, jargon or unnecessary questions. Simple and usable audit checklists
developed over 25 years through practical use in the real world.
Further guidance on ISO 27001 documentation and internal auditing:
Download this audit checklist with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This checklist is also included in the ISO 27001 Toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help completing your internal audits or training your internal auditors, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
ISO 27001:2022 Documentation Checklist Template
A documentation checklist for ISO 27001:2022, listing the documents and records an information security management system is expected to hold, each with the clause or Annex A control it comes from. It is set out on the F-Q2 Audit Checklist format, with the scope, criteria, auditor and date recorded at the top and space against the list to record the evidence viewed, responses and findings.
Use it when setting up an information security management system to see which documents are already in place and which are still needed, or as the record of a documentation audit before the certification audit.
Note: ISO clause checklists only include the clause numbers and short prompts for each clause (due to copyright reasons) and therefore a full version of the ISO standard is required to be used in conjunction with these checklists.
What the Checklist Covers
- Core ISMS documents - the scope of the ISMS, the information security policy and objectives, the risk assessment and risk treatment methodology, the Statement of Applicability and the risk treatment plan
- Operational records - information on planned processes, the risk assessment report and the results of risk treatment
- Annex A documents - security roles and responsibilities, the inventory and acceptable use of assets, incident response and incident management, backup, access control and operating procedures for IT management
- Technical and supplier documents - secure system engineering principles, configuration management, supplier security processes, business continuity and ICT continuity requirements, legal, regulatory and contractual requirements, and confidentiality agreements
- Mandatory records - competence evidence, monitoring and measurement results, the internal audit programme and its results, management review results, nonconformities and corrective actions, and logs of user activities and security events
Using the Checklist
Record the scope and criteria at the top, then work down the list, noting where each document or record is held and anything still needed. Follow up any gaps as actions, so the documentation is complete before the certification audit and stays complete as the system changes.
Planning the Audit
Have the document register, the Statement of Applicability and the risk treatment plan to hand, along with the standard itself. The Statement of Applicability shows which Annex A controls apply, so a document listed against an excluded control can be marked as not applicable with the reason, rather than left blank.
Recording the Evidence
Against each document or record, note the reference, title and version seen, or where the record is kept, so the next audit can go straight to it. Where a document exists but is out of date or not approved, record it as a finding rather than a tick, and raise any missing document as a corrective action so its progress can be followed.
Included in the ISO 27001 Toolkit
This checklist is part of the ISO 27001 Toolkit and the integrated toolkits that include it.
Related Documents
Documents that work alongside this checklist:
Would you rather we did it for you?
Our Internal Audit Training and Support service works through your internal audits with you while training your own people as internal auditors, so the audits are completed and the skills stay in the business.
Internal Audit Training and Support