ISO 27001 requires a short list of documents, such as the scope, the information security policy and the Statement of Applicability, and a short list of records, such as audit and review results. Documents tied to Annex A controls are mandatory only when your risks or interested parties call for those controls.
Documents from the main clauses
These come from clauses 4 to 8, and each is introduced with "shall" wording in the standard:
- Scope of the ISMS (4.3)
- Information security policy (5.2)
- Risk assessment and risk treatment process (6.1.2)
- Statement of Applicability (6.1.3 d)
- Risk treatment plan (6.1.3 e, 6.2, 8.3)
- Information security objectives (6.2)
- Risk assessment and treatment report (8.2, 8.3)
Records from the main clauses
- Evidence of training, skills, experience and qualifications (7.2)
- Monitoring and measurement results (9.1)
- Internal audit program and results (9.2)
- Management review results (9.3)
- Results of corrective actions (10.2)
Items tied to Annex A
A second group depends on which controls you apply. One published list names these:
- Inventory of assets (A.5.9)
- Acceptable use of assets (A.5.10)
- Incident response procedure (A.5.26)
- Statutory, regulatory and contractual requirements (A.5.31)
- Security operating procedures for IT management (A.5.37)
- Security roles and responsibilities (A.6.2, A.6.6)
- Security configurations (A.8.9)
- Secure system engineering principles (A.8.27)
- Logs of user activity, exceptions and security events (A.8.15)
The rule that matters: these are mandatory only if risks or interested party requirements call for the matching control. If you exclude a control in the Statement of Applicability, the document tied to it does not become a gap.
What is not on the list
An internal audit procedure, a nonconformity procedure and a management review procedure are common, but they are not themselves mandatory. Many small teams write fewer documents than consultants suggest.
ISO does not publish an official checklist of mandatory documents. Lists like this one are derived from the "shall" language in the standard, so check your copy of the text and ask your certification body if a case is unclear.
Keep documents controlled
Documented information needs control too. Each document needs an owner, a version, an approval and a place where the current copy lives. An auditor who finds three versions of the access policy will ask which one is real.
Quick check
Do I need a policy for every Annex A control?
No. Written documents for Annex A controls are mandatory only where your risks or interested party requirements call for the control. Many controls can be covered by a short procedure or a line in the Statement of Applicability.
Is a risk treatment plan the same as the Statement of Applicability?
No. The risk treatment plan says how each risk will be treated and by whom. The Statement of Applicability lists the controls that apply, with reasons and status.
Sources
Last reviewed: 19 October 2026.
