Templates and records · ISO 27001

ISO 27001 templates and records

Nine records that hold an information security management system together, each with the clause or control that calls for it, its fields and a completed example.

In one sentence

ISO/IEC 27001 requires you to document the risk assessment process, its results, the risk treatment plan and the statement of applicability, which form the core of any certification; the remaining records —asset inventory, incidents, access reviews, continuity tests, suppliers— stem from the Annex A controls that the organisation itself declares applicable, and they are the evidence the auditor asks for to confirm those controls work.

Content reviewed on 17 October 2026

Edition: ISO/IEC 27001:2022 The transition from the 2013 edition ended on 31 October 2025
Core documents: Risks, treatment and SoA Clauses 6.1.2, 6.1.3, 8.2 and 8.3
Annex A: 93 controls in 4 themes Organisational, people, physical and technological
Format: Free The standard sets the content, not the template

Contents

ISO 27001 templates and records

Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.

Frequently asked questions

What people ask us before getting started

Which documents are mandatory in ISO 27001?

Those required by the clauses of the standard: scope (4.3), policy (5.2), the risk assessment process and results (6.1.2 and 8.2), the risk treatment process and results (6.1.3 and 8.3), the statement of applicability (6.1.3 d), objectives (6.2), evidence of competence (7.2), monitoring results (9.1), the audit programme and results (9.2), management review (9.3) and nonconformities with their actions (10.2). On top of these comes whatever the Annex A controls declared applicable require.

Do Annex A controls require records?

Indirectly. A control declared applicable has to be demonstrable, and in practice that is done with records: the asset inventory for control 5.9, the incident log for controls 5.24 to 5.28, or access review minutes for 5.18. A control excluded with a justification needs no evidence of operation.

Do the same records work for the ENS?

Largely, yes: the risk assessment, the inventory and the incident log can be shared with the Spanish National Security Framework (ENS). What cannot be shared is the statement of applicability, because the ENS has its own catalogue of measures in Annex II of Royal Decree 311/2022 and its own sign-off.

Keep your ISO 27001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022
ISO/IEC 27005:2022 — Guidance on managing information security risks ISO/IEC · October 2022

ISO 27001 templates and records

In one sentence

ISO 27001 templates and records

Statement of applicability

Risk assessment

Risk treatment plan

Asset inventory

Legal and contractual requirements

Incident log

Access review

Continuity and backup tests

Supplier security

What people ask us before getting started

Which documents are mandatory in ISO 27001?

Do Annex A controls require records?

Do the same records work for the ENS?

Keep your ISO 27001 records without loose templates

Related pages

ISO 27001, without folders or surprises

ISO 27001 · Information security

Where each figure comes from