ISO 27001 manual: do you need to write one?
No, ISO 27001 does not require a separate manual. The standard asks for a limited set of documented information on specific points, such as your policy, your scope and your risk assessment. A manual is a choice. It can be useful as an entry point to the whole ISMS, as long as it refers to the actual documents and does not become a thick text that nobody reads. You can read which documents are mandatory on mandatory documents. For how everything fits together, see the ISMS, and for the first steps, see the step-by-step plan.
What the standard does require
The mandatory documents are spread across the standard. For the manual, it is important to know that each of them can exist as an independent document. The key points are:
- the scope of the ISMS (clause 4.3, see determining the scope)
- the information security policy (clause 5.2, see the policy)
- the process for risk assessment and risk treatment (clauses 6.1.2 and 6.1.3)
- the Statement of Applicability (SoA), see statement of applicability
- the objectives (clause 6.2)
- evidence of competence (clause 7.2)
- evidence of monitoring, internal audit and management review (clauses 9.1 to 9.3)
- evidence of nonconformities and corrective actions (clause 10.2)
A manual can be a table of contents that refers to the actual documents. In that case you meet the standard without duplicate work.
Three forms of an ISMS manual
Organisations usually choose one of three routes. The best one depends on the size of the organisation and how it already works.
| Form | What it is | Suitable for | Pitfall |
|---|---|---|---|
| No manual, only an index | One overview page with links to all documents | Small teams with a good wiki | The index falls behind if nobody maintains it |
| Short manual | Two to five pages: scope, structure and references | Most SMEs (small and medium-sized enterprises) | Too much content that already appears in the policy |
| Extensive manual | Full description of processes and controls | Large organisations with several locations | Double maintenance, and a lot of outdated text |
For most organisations with a few dozen employees, the short manual is a good middle way. It gives the auditor one entry point and keeps the content with the source.
Example: table of contents for a short manual
This is a fictional example for “Example BV”. Each section refers to the document where the content actually lives.
| Section | Content in the manual | Refers to | Owner |
|---|---|---|---|
| 1. Purpose and scope | What the ISMS covers, in two sentences | Scope document, version 2.0 | Security officer |
| 2. Organisation and roles | Who is responsible for what | Organisation chart, RACI table | Management board |
| 3. Policy | The policy in one paragraph | Information security policy, version 3.1 | Management board |
| 4. Risks | How risks are assessed and treated | Risk procedure, risk register | Security officer |
| 5. Controls | Which controls apply | Statement of Applicability | Security officer |
| 6. Objectives | The current objectives in a table | Objectives overview | Management board |
| 7. Monitoring and audit | How performance is measured and checked | Audit planning, audit reports | Security officer |
| 8. Improvement | How nonconformities are resolved | Nonconformity register | Operations |
| 9. Document control | How documents are created, approved and kept | Document procedure | Security officer |
The table is the manual. It is short, the content stays with the source, and the auditor can click through to each part.
What the auditor wants to see
The manual itself is rarely the focus of the audit. The auditor checks whether the documents you mention exist, are up to date and are under control. Clause 7.5 covers this: each document has a version, an approval, a review date and a place where it is kept. A manual that is at version 1.0 and three years old, while the policy is at version 3.1, can lead to a nonconformity. See the audit questions and checklist for the questions that go with this.
When is a manual useful?
- You have several locations or teams that need to know the same arrangements.
- You need to explain how the ISMS works to customers or in a tender.
- You combine ISO 27001 with other standards and want one entry point for the integrated system. See ISO 27001 vs other standards.
- You need to onboard new employees into the information security system.
When can you skip it?
If your ISMS is small, the documents are easy to find in a wiki and everyone knows them, a manual adds little. A one-page index is then enough. The step-by-step plan shows which documents you write in which phase, without a manual being needed.
Common mistakes
- The manual copies the policy. Then there are two versions of the same text, and they start to differ.
- A template from the internet. Auditors recognise generic manuals. They do not fit your processes.
- The manual is left untouched after certification. It must be maintained like any other document.
- References that do not work. A link to a document that has been renamed or moved is a small but visible error.
How to write a short manual
Writing a short manual usually takes less time than people expect, if you already have the documents.
Take stock of what you already have
Make a list of all documents that affect the ISMS, including those stored in a folder or wiki. That is often more than you think.
Choose your structure
Use the nine sections in the table above as a starting point. Remove any that do not apply.
Refer instead of copying
For each section, write two or three sentences and a link to the source document. Do not repeat policy text.
Give the manual an owner and a date
As with any other document: a version, an approval and the date of the next review.
Frequently asked questions
Does the certification body ask for a manual? Not as such. They want to see the documents the standard requires, and evidence that they work.
Is a manual mandatory for ISO 9001 and ISO 27001 together? Not in that case either. A combined manual is possible. See combining ISO 27001 and ISO 9001 for the overlap.
How long should a manual be? As short as you can make it. Two pages that are correct are better than forty that are out of date.
More information
- Standard: NEN-EN-ISO/IEC 27001 (Dutch publication)
- Internal: mandatory documents, the ISMS explained, the step-by-step plan