ISO 27001 clause 7: support and document control

Clause 7 is five requirements and almost none of them can be satisfied retroactively. Competence, awareness and document control all leave dated records, and a record that was never made on the day is a finding you cannot argue your way out of.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Clause 7 of ISO/IEC 27001:2022 carries five requirements: 7.1 resources, 7.2 competence, 7.3 awareness, 7.4 communication and 7.5 documented information. Together with clause 6 it accounts for ten of the 25 mandatory requirements, and it is where evidence is sampled per person rather than per system. An auditor picks five employees from your list, asks for the training record, the acknowledgement and the competence evidence for each, and one gap in five is enough to write a finding.

What clause 7.5 actually requires of a document

Clause 7.5 breaks into three parts and only the third is difficult. 7.5.1 says you keep the documented information the standard requires plus whatever you determine is necessary. 7.5.2 says documents get identified, described, formatted and approved. 7.5.3 is the control regime, and it is a longer list than most people build for.

The last row is the one nearly every first-time project misses. Clause 7.5.3 explicitly covers documented information of external origin determined to be necessary. If your operating procedure depends on a vendor's hardening guide, that guide is an external document and it needs to be identified, its version tracked, and someone made responsible for noticing when it changes.

Which documents are actually mandatory

Fewer than most template packs sell. The standard names a specific set of documented information across the clauses, and everything beyond it is whatever you determined necessary under 7.5.1. Work through this list before buying a template pack, because the pack will typically contain forty documents and the requirement is closer to fifteen.

0 of 0 in place · Reset

• Scope of the ISMS, clause 4.3
• Information security policy, clause 5.2
• Risk assessment process, clause 6.1.2
• Risk treatment process, clause 6.1.3
• Statement of Applicability, clause 6.1.3 d)
• Information security objectives, clause 6.2
• Evidence of competence, clause 7.2
• Documented information needed for confidence that processes ran as planned, clause 8.1
• Results of the risk assessments, clause 8.2
• Results of risk treatment, clause 8.3
• Monitoring and measurement results, clause 9.1
• Internal audit program and results, clause 9.2
• Management review results, clause 9.3
• Nature of nonconformities and actions taken, clause 10.2
• Results of corrective action, clause 10.2

Annex A controls you declared applicable will add their own documents, which is where the access control policy, the supplier policy and the incident procedure come from. The full treatment of the required set, including what a certification body asks to see before stage 1, is on the documentation page.

Competence, and why it is not the same as training

Clause 7.2 asks four things: determine the competence necessary for people whose work affects information security performance, ensure they are competent on the basis of education, training or experience, take action where they are not, and retain documented information as evidence. The word evidence is doing the work. Competence is a conclusion you reached about a person, and the record has to show the basis.

Competence, clause 7.2

Role-specific. Why is this person qualified to run the internal audit, own the risk register, or administer production access. Evidenced by a certification, a qualification, a prior role, or a documented assessment.

Awareness, clause 7.3

Everyone. They know the policy exists, they know how their work contributes, and they know what happens if they do not conform. Evidenced by training completion with a date and a name.

The distinction auditors test

A company with 100 percent security awareness training completion and no competence evidence for the three named ISMS roles has satisfied 7.3 and failed 7.2. That is a common and avoidable finding.

Awareness training does not have to be a purchased platform. An annual session with a slide deck, an attendance list and a short quiz satisfies the clause. What it does have to be is repeated, dated, and extended to contractors and to anyone else doing work under your control, which is the phrase in 7.3 that catches companies who trained employees and skipped the six long-term contractors in the delivery team.

Clause 7.4 in one table

The shortest requirement in the standard and the one most often satisfied with a document written the week before the audit. It asks what you communicate, when, with whom and how. Half a page is enough, provided it is true.

Clause 7.1 and what counts as adequate

One sentence in the standard: determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the management system. It is judged by outcome. If the internal audit is late, the access reviews are three quarters behind and the risk register was last touched eleven months ago, the auditor concludes resources were not adequate regardless of what the budget said.

For a Canadian company under 100 staff, adequate usually means one part-time internal owner with real time allocated, plus purchased help at the two points where independence is required: the internal audit at $6,000 to $15,000 CAD a year, and the certification body itself. Where there is no internal owner at all, the honest options are to hire, to retain a fractional security lead, or to accept that the management system will decay between audits and the surveillance visit will find it.

Where clause 7 is worth less than it costs

The counter-case. Two parts of clause 7 attract spending far out of proportion to the finding they prevent. The first is document management tooling. A dedicated compliance platform at $8,000 to $30,000 CAD a year solves document control, and so does a version-controlled repository you already pay for, with an approval step and a retention note. If the platform is being bought mainly for 7.5, it is an expensive answer to a solved problem, and the cost page puts the platform line in context against the rest of the budget.

The second is training content. There is a large market in security awareness subscriptions and clause 7.3 asks for three things a person needs to be aware of. A twenty-person company running one live session a year with an attendance sheet is compliant and is often better attended than a purchased module. Buy the subscription when phishing simulation is genuinely part of your control set, not to satisfy this clause.

The order that avoids rework

1. Decide where documents live before you write any. Moving forty documents later destroys the version history that clause 7.5.3 asked for.
2. Set the approval route and the retention schedule at the same time, in one short document control procedure.
3. Write the competence requirements for the named ISMS roles before you appoint anyone, so the evidence is gathered rather than reconstructed.
4. Start awareness training immediately, even before the policies are finished, because the clock on dated evidence starts the day you run it.
5. Write the communication plan last, from what actually happens, rather than first, from what you intend.

Clause 7 evidence accumulates over calendar time, which is the same constraint that governs the whole project. The implementation timeline shows where it sits, and the readiness page covers how to tell whether you have enough of it yet.

Common questions