Document control

1 - Company documents such as "Contracts" signed with various clients. Does this form part of "internal" documents or external.

Answer: Documents that need interaction with external parts, such as clients or suppliers, must be considered as external. So contracts must be considered external documents.

2 - Would we have to follow a Change History table on them too?

ISO 27001 requires that changes on documents are controlled, but the standard does not prescribe how, so you do not need to necessarily use a change history table.

What generally happens with contracts is that changes on them are included as annexes, pointing out which clauses have been included, excluded, or changed.

These materials will also help you regarding document management and ISO 27001:

• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
• Free online training ISO 27001:2013 Lead Implementer Course https://advisera.com/training/iso-27001-lead-implementer-course/