Clause 7.5.3 Documented information: control
Clause 7.5.3 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Documented information: control. Documented information that the standard and the ISMS call for must be controlled so that people can get it, in a usable state, at the place and time they need it, and so that it is suitably protected, for example against loss of confidentiality, misuse or loss of integrity. As applicable, the organization addresses distribution, access, retrieval and use; storage and preservation including keeping it legible; control of changes such as version control; and retention and disposition. External documented information the organization needs for planning and operating the ISMS is identified as appropriate and controlled. A note explains that access can mean permission only to view, or also the right to edit.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 7.5.3 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 7), in our words, not a statement of the standard and not binding on an assessor.
- A document control procedure covering distribution, access, storage, version control, retention and disposal
- Access permissions on the document repository showing view and edit rights
- Version histories and change records for ISMS documents
- A register of external documents such as standards and regulations used by the ISMS