ISMS TIER 1 - 4 Documents

Please note that ISO 27001 does not prescribe or make reference to documents tiers.

Considering that, the concept of tiers is a common interpretation made by organizations to make ISO documentation management easier to understand.

In this interpretation the tiers are:

1. Policies: define rules for the ISMS. They are composed of the Information Security Policy and additional subject-specific policies (e.g., Access Control Policy, Backup Policy, etc.).
2. Procedures: they describe what needs to be done, by who, when, and in what order.
3. Work instructions: they detail how specific tasks are performed.
4. Records: documents that provide evidence of performed activities or results achieved.

This material will provide you a further explanation about document management:

• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/