Equipment Sitting and Protection A.11.2.1

Advisera's ISO 27001 Documentation Toolkit does not have a document for each and every control from ISO 27001 because of the following reasons:

1. ISO 27001 does not require each and every control to be documented
2. If the toolkit had a document for each control, there would be too many documents and this would be an overkill for smaller and mid-size companies.

Since our target are SMEs, we have decided to include an optimum amount of documents for companies of this size - the toolkit includes:

• All the mandatory documents - e.g. Information Security Policy, Statement of Applicability, Risk Assessment Methodology, Access Control Policy, etc.
• Documents that are not mandatory, but are commonly used - e.g. BYOD Policy, Classification Policy, Password Policy, Backup Policy, etc.

In case you have a real need for a document not included in the toolkit you can ask for support through email, or schedule an online meeting, so one of our experts can help you develop such a document.

I am implementing this as we required by our customer, who are Banks. They advise we must adhere to the policies they do as we process their data. Yes we are a small business, only doing small home insurance repairs, however if fulfilling all their requirements means we become one of their preferred suppliers we will do it.