ISO 27001 Mandatory Documents and Records: The Complete List

ISO/IEC 27001:2022 requires specific documented information. Below is the locked core list used for this site’s P1 programme — clause references, not a vendor “100 policies” pack.

List lock: Treat this as the mandatory floor. Your SoA and Clause 7.5/8.1 needs may add procedures and records for effectiveness.

Mandatory Documented Information (Core)

Clause

Documented information

4.3

Scope of the ISMS

5.2

Information security policy

6.1.2

Information security risk assessment process

6.1.3

Risk treatment process and Statement of Applicability

6.2

Information security objectives

7.2

Evidence of competence

8.1

Documented information necessary for operational processes

8.2

Results of information security risk assessments

8.3

Results of information security risk treatment

9.1

Evidence of monitoring and measurement results

9.2.2

Evidence of the audit programme(s) and audit results

9.3.3

Results of management reviews

10.2

Evidence of nonconformities, actions, and corrective-action results

Operationalize ISO 27001:2022 with Continuous Evidence

CyberSilo CSA tracks SoA and mandatory records; ThreatHawk supports logging and monitoring artefacts for technological controls.

Talk to CyberSilo ISO 27001 Automation

Frequently Asked Questions

Is every procedure mandatory?

No. The standard explicitly requires documented information in specific clauses. Additional procedures are often necessary for effectiveness (7.5.1 / 8.1) but are not an infinite fixed checklist.

Where is the SoA required?

Clause 6.1.3 d).

Which clause covers corrective action records?

Clause 10.2 — evidence of the nature of nonconformities and subsequent actions, and of the results of corrective action.

ISO 27001 hub · 93 controls · SoA · CSA · Policy templates

ISO 27001 Mandatory Documents and Records: The Complete List

Mandatory Documented Information (Core)

Operationalize ISO 27001:2022 with Continuous Evidence

Frequently Asked Questions

Is every procedure mandatory?

Where is the SoA required?

Which clause covers corrective action records?

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)

ISO 27001 Mandatory Documents and Records: The Complete List

Mandatory Documented Information (Core)

Operationalize ISO 27001:2022 with Continuous Evidence

Frequently Asked Questions

Is every procedure mandatory?

Where is the SoA required?

Which clause covers corrective action records?

Related ISO 27001 Resources

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)