Template based on ISO/IEC 27001:2022
ISO 27001 mandatory documents list template
The documented information from clauses 4 to 10 and typical Annex A documents, each row with its clause and columns for your status.
What the file contains
16 items of documented information from clauses 4 to 10 and 7 typical Annex A documents, each row with clause, type and example. You fill in the columns for status, document, owner and next review.
- Clauses 4 to 10: explicitly required documented information 16 rows
- Annex A: documents when the control is applicable 7 rows
Template version 1.0-228591ab · content as of 26 September 2026 · Excel (XLSX) 51 KB · PDF 19 KB
This template exists in German and English; you get the English version.
This template is not legal advice. It does not replace checking which requirements apply to your company and does not guarantee any audit or certification result. License CC BY 4.0
How to use the file
Take stock
Enter what already exists: rules from quality management, work instructions, contracts, training lists.
Close the gaps
Compare the list with your Statement of Applicability. Several items may sit in one document.
Set document control
For each document an owner, a version and the next review. Clause 7.5 covers how you handle documents.
The portal takes it from there
The ISO 27001 project in Complass includes the scope, policy, risk assessment methodology, risk register, risk treatment plan, audit program and management review as guided templates, among others. Every document has an owner, a version and a review cycle, and the portal reminds you of the review.
Questions fréquentes
How many mandatory documents does ISO 27001 have?
There is no fixed number, because the standard does not prescribe a list of files. Overviews arrive at different totals depending on how they count. What matters is that every requirement is covered.
Does every document have to be a separate file?
No. You can combine items as long as an auditor can find them. One method can cover both risk assessment and treatment, for example.
Why is Annex A a separate part?
You need these documents only when your Statement of Applicability marks the control as applicable. The template marks where the control itself asks for documentation and where a document is only common practice. The selection is our reading, not a complete list.
Testez Complass avec vos propres données
Créez vous-même votre accès d'essai, avec un projet d'exemple par référentiel si vous le souhaitez. Si vous préférez d'abord voir Complass, demandez une démo.