Which documents does ISO 27001 require?

• ISMS scope (clause 4.3).
• Information security policy (clause 5.2).
• Risk assessment process (clause 6.1.2).
• Risk treatment process (clause 6.1.3).
• Statement of Applicability (clause 6.1.3 d).
• Information security objectives (clause 6.2).
• Documents needed to control operations (clause 8.1), to the extent necessary to be confident processes run as planned.

• Evidence of competence (clause 7.2).
• Results of risk assessments (clause 8.2).
• Results of risk treatment (clause 8.3), with the risk treatment plan of clause 6.1.3 e.
• Monitoring and measurement results (clause 9.1).
• The audit programme and audit results (clause 9.2).
• Management review results (clause 9.3).
• Nonconformities, the actions taken and the results of corrective action (clause 10.2).

Annex A controls you mark as applicable in the Statement of Applicability often need their own documents, for example topic-specific policies (5.1), the asset inventory (5.9), acceptable use rules (5.10), the incident response procedure (5.26), legal and contractual requirements (5.31) and documented operating procedures (5.37). Clause 7.5 also requires you to control all documented information: version, approval, availability and retention.

In Acuna GRC, policies and procedures live in Documents, with an approval workflow, numbered revisions and a yearly review date. Requirements marked Not applicable carry a justification, risks carry their treatment plans, and objectives have their own register. Records prove that controls and tasks ran, audits are planned in programs, and issues lead to corrective actions with a root cause. See the Operate workspace and the Assure workspace.