Posts Tagged ‘ISO 27001:2013 documentation kit’

As part of your ISO 27001 Certification project, your organisation will need to prove its compliance with appropriate documentation. If you’re just starting to implement ISO 27001 in your company, you’re probably in a dilemma as to how many documents you need to have, and whether to write certain policies or not.

ISO 27001 Certification states that it is necessary to document an information security policy.

What is an information security policy?

Information Security Policy

An information security policy could be a set of rules or needs that govern however your organization and its employees will try to manage its digital resources and assets in a very safe manner. It is one of the mandatory ISO 27001 documents and sets out the requirements of your information security management system (ISMS).

The policy should be a short and simple document, approved by the board which defines management direction for information security in accordance with business requirements and relevant laws and regulations.

Key elements of your information security policy

An information security policy needs to reflect your organisation’s view on information security and must:

  • Provide information security direction for your organisation;
  • Include information security objectives;
  • Include information on how you will meet business, contractual, legal or regulatory requirements; and
  • Contain a commitment to continually improve your ISMS.

The ISO 27001 Policy should help drive your approach to scoping the ISMS and implementation project. An information security policy needs to include all employees in an organisation, and may also consider customers, suppliers, shareholders and other third parties. It’s important to consider how the policy will impact on these parties and the effect on your organisation as a result.

Help with creating an information security policy template

The information security policy is one of the most important documents in your ISMS.

Knowing where to start when compiling your information security policy can be difficult, especially in large or complex organisations where there may be many objectives and requirements to meet.

The ISO 27001:2013 Documentation Toolkit contains a customisable information security policy template for you to easily apply to your organisation’s ISMS.


Arguably one of the most difficult elements of achieving ISO 27001 certification is providing the documentation for the information security management system (ISMS). The ISO 27001 documentation that is required to create a conforming system, particularly in more complex businesses, can sometimes be up to a thousand pages.

The key sections of ISO 27001 set out a range of documents requirements for developing, implementing and maintaining Information Security Management System.

Requirements of Documents for ISO 27001 Certification:

ISO 27001:2013 documents

  1. ISMS Manual:

    The ISO 27001 manual is a mandatory document for ISO 27001 Certification, which maintains information security management system in organization. This is a roof document for ISMS, and it usually includes the ISMS scope, role(s) undertaken by the organization, exclusions from the standard, references to relevant documents, and the business process model.

  2. ISO 27001 Procedures:

    ISO 27001 procedures documents required as necessary for effective planning, operation, control and monitoring of realization processes improvements. Mandatory procedures cover all the clause requirements to follow while implementation of Information Security Management System for preparing and maintaining medical devices.

  3. Standard Operating Procedures:

    ISO 27001 SOPs documents covers sample copy of work instructions to link with significant aspects issues in the organization. It takes care of all such issues and used as a training guide as well as to establish control and make system in the organization. It defines various processes and provides quick and easy answers to common Standard Operating Procedures (SOP) questions.

  4. Process Flow Charts:

    It covers guideline for processes, process model. It covers process flow chart activities of all the main and critical processes with input – output matrix for manufacturing organization. It helps any organization in process mapping as well as preparing process documents for own organization.

  5. ISO 27001 Policies:

    ISO 27001:2013 Policy is to define the purpose, direction, principles and basic rules for information security management. It covers guideline for controls applied as per ISO 27001:2013 Certification guidelines. The policy document templates are provided to frame the information security controls

  6. ISO 27001 Formats :

    ISO 27001 formats documents designed and required to maintain records as well as establish control and make system in the organization.

  7. ISO 27001 Audit Checklists:

    ISO 27001 audit checklist documents audit questions based on ISO 27001:2013 requirements as well as for Clause wise questions and department wise question. It will be very good tool for the auditors to make audit Questionnaire / clause wise audit Questionnaire while auditing and make effectiveness

Containing every document template you could possibly need (both mandatory and optional), as well as additional work instructions, project tools and documentation structure guidance, the ISO 27001:2013 Documentation Toolkit really is the most comprehensive option on the market for completing your documentation.