Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

Document Control Register

Updated on 2 min Reviewed by: Cenedril-Redaktion
A.5.1Clause 7.5 ISO 27001

The document control register is the index of all controlled documents in your ISMS. It shows at a glance which policies are in force, who owns them, which version is current and when the next review is due.

ISO 27001 Clause 7.5 (Documented Information) requires that documented information is identified, controlled and kept available. A.5.1 (Policies for Information Security) adds that the information security policy must be reviewed at planned intervals. The document control register is the operational tool that fulfils both requirements.

What does it contain?

Each row represents one controlled document. The columns:

  • Doc ID / Title / Type — unique identifier, title and document type (Policy, Procedure, Record, Form)
  • Owner / Approver — responsible person and approving authority
  • Version / Effective Date — current version number and date of effect
  • Last Review / Next Review — last review date and next due date
  • Classification / Distribution / Status — information classification, distribution list and current document status

How to use it

Initial population: Gather all existing ISMS documents and enter them with their current version and review status. Documents without a clear owner or without documented approval become immediately visible.

Ongoing maintenance: With every document change, update Version, Effective Date and Last Review. New documents receive a Doc ID and are added straight away.

Review cycle: Once a month (or quarter), filter the register for entries whose Next Review is due and initiate the review. This ensures no outdated policy stays in circulation.

Register Template

Document Control Register

.csv · EN.csv · DE
Doc IDTitleTypeOwnerApproverVersionEffective DateLast ReviewNext ReviewClassificationDistributionStatus
POL-001Information Security PolicyPolicyISOCEO2.02026-01-152026-01-152027-01-15InternalAll employeesPublished
POL-002Risk Management PolicyPolicyISOCEO2.02026-01-152026-01-152027-01-15InternalAll employeesPublished
POL-003ISMS Governance PolicyPolicyISOCEO1.32025-10-012025-10-012026-10-01InternalAll employeesPublished
POL-004Acceptable Use PolicyPolicyISOCEO2.12026-02-012026-02-012027-02-01InternalAll employeesPublished
POL-005Access Control PolicyPolicyISOIT Operations Lead2.02026-01-152026-01-152027-01-15InternalIT + Department HeadsPublished
POL-006HR Security PolicyPolicyHR LeadCEO1.52025-11-012025-11-012026-11-01InternalHR + All employeesPublished
POL-007Information Classification & Labelling PolicyPolicyISOCEO1.42025-09-152025-09-152026-09-15InternalAll employeesPublished
POL-008Information Transfer PolicyPolicyISOCEO1.22025-12-012025-12-012026-12-01InternalAll employeesPublished
POL-009Business Continuity PolicyPolicyBCM LeadCEO1.62026-02-152026-02-152027-02-15InternalAll employeesPublished
POL-010Supplier Security PolicyPolicyProcurement LeadISO1.32025-11-202025-11-202026-11-20InternalProcurement + Dept HeadsPublished
POL-011Security Operations PolicyPolicyISOCEO1.42026-01-152026-01-152027-01-15InternalSecOps + ITPublished
POL-012Intellectual Property Rights PolicyPolicyLegalCEO1.12025-07-012025-07-012026-07-01InternalAll employeesPublished
POL-013Project Management Security PolicyPolicyPMO LeadISO1.02025-08-152025-08-152026-08-15InternalPMO + Project ManagersPublished
POL-014Remote Working & BYOD PolicyPolicyISOHR Lead1.52026-01-102026-01-102027-01-10InternalAll employeesPublished
POL-015Physical Security PolicyPolicyFacilities LeadISO1.22025-10-152025-10-152026-10-15InternalFacilities + ReceptionPublished
POL-016Endpoint Security & Malware Protection PolicyPolicyIT Operations LeadISO1.42025-12-152025-12-152026-12-15InternalIT + All employeesPublished
POL-017Cryptography PolicyPolicyISOIT Operations Lead1.32025-11-012025-11-012026-11-01InternalIT + DevelopersPublished
POL-018Data Deletion Masking & Leakage Prevention PolicyPolicyDPOISO1.12025-09-012025-09-012026-09-01InternalAll employeesPublished
POL-019IT Operations PolicyPolicyIT Operations LeadISO1.52026-02-012026-02-012027-02-01InternalITPublished
POL-020Configuration & Change Management PolicyPolicyIT Operations LeadISO1.32025-12-012025-12-012026-12-01InternalIT + DevelopersPublished
POL-021Secure Development PolicyPolicyHead of EngineeringISO1.42026-01-202026-01-202027-01-20InternalEngineeringPublished
PROC-001Incident Response PlanProcedureISOCEO2.02026-03-012026-03-012027-03-01ConfidentialSecOps + ITPublished
PROC-002Business Continuity PlanProcedureBCM LeadCEO1.32026-02-202026-02-202027-02-20ConfidentialBCM teamPublished
PROC-003Disaster Recovery PlanProcedureIT Operations LeadISO1.22026-02-202026-02-202027-02-20ConfidentialITPublished
REC-001Statement of ApplicabilityRecordISOCEO3.02026-03-302026-03-302027-03-30InternalAuditors + ManagementPublished
REC-002Risk RegisterRecordISOCEOLive2026-04-012026-04-01ContinuousConfidentialISMS teamLive

Sources

ISO 27001 Controls Covered

A.5.1 Policies for information security Clause 7.5 Documented information

Frequently asked questions

Which documents belong in the register?

All documented information your ISMS requires: policies, procedures, records, forms and external reference documents (e.g. standards). Clause 7.5 distinguishes between documents you create and those you adopt from outside — both must be controlled.

How often should ISMS documents be reviewed?

ISO 27001 does not prescribe a fixed interval. Common practice: policies annually, operational procedures as needed (at least annually), records at every use. The register includes Last Review and Next Review columns to keep track.

Do I need a dedicated tool for document control?

For a small ISMS, a well-maintained register (CSV or spreadsheet) combined with a storage system that supports versioning (SharePoint, Confluence, Git) is sufficient. Beyond roughly 50 controlled documents, a specialised tool pays off because manual version control becomes error-prone.