Documenting controls
Assign topic to the user
Answer:
First lets understand the differences between these documents. Normally policies define general guidelines (what must be done), while procedures are more specific (defining how to perform an activity), but it is not mandatory that your documentation is divided in such way.
Considering that, if your "policy" fulfills requirements from Annex A control A.9.4.2 this is compliant with ISO 27001 and will be acceptable for certification audit.
These articles will provide you further explanation about documenting controls:
- How to structure the documents for ISO 27001 Annex A controls https://advisera.com/27001academy/blog/2014/11/03/how-to-structure-the-documents-for-iso-27001-annex-a-controls/
- How detailed should the ISO 27001 documents be? https://advisera.com/27001academy/blog/2014/09/ 22/detailed-iso-27001-documents/
These materials will also help you regarding documentation:
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/
Comment as guest or Sign in
Mar 14, 2019