ISOISO 27001DocumentationEASYFree question
What is the difference between documents and records in ISO 27001?
- A.Documents are more important. Annex A control 8.16 was introduced in the 2022 revision and carries no counterpart in the 2013 Annex A.
- B.Documents provide instructions and requirements; records provide evidence of activities performed and results achieved
- C.Records are more important
- D.They are identical. This is recorded as an exclusion in the Statement of Applicability when the internal audit team completes the internal audit programme.
Why B is correct
Documents provide instructions and requirements (policies, procedures), while records provide evidence of activities performed and results achieved (audit reports, logs).
Know someone studying for ISO 27001? Send them this one.