Guest user Created: Jan 12, 2016 Last commented: Jan 12, 2016

Documentation control

I have one question regarding the procedure of documentation control (7.5). This document defines how to handle documents which are produced within the ISMS such as BYOD Policy or Risk Assessment Methodology but what about documents which are in the company anyway. I am talking not only about policies which were issued long before the implementation process even started or documents which you would actually include as Assets. I am thinking of stuff like contracts, Mail, E-Mail.... Does the documentations control procedure apply to those as well?

0 0

Assign topic to the user

Select user

Guest

AntonioS Jan 12, 2016

The documentation control is mostly for the documentation of the ISMS, and a contract can be a document in the ISMS, but anyway you can apply the documentation control to any document of your company. But for me, It is very hard to consider an email as a document, because there are different emails in a day, and you do not have a control version, changes, etc, The management of particular documents or records does not have to be defined centrally in a Procedure for Document Control - you could have e.g. Supplier Policy where you define the rules for handling supplier contracts.

Finally, please read this article if you need more information about the document management Document management in ISO 27001 & BS 25999-2 : https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 12, 2016

Expert Advice Community