ISO 27001 Chapter Matrix

ISO 27001 chapter	Related documentation
4.1 Understanding the organization and its context	ISMS Scope Statement
4.2 Understanding the needs and expectations of interested parties	ISMS Scope Statement
4.3 Determining the scope of the information security management system	ISMS Scope Statement
4.4 Information security management system	27001 Control Matrix Annex A Control Matrix Policies Procedures Guidelines References Checklists Evidence of measures for Annex A Controls (see example control)
5.1 Leadership and commitment	ISMS roles approved by ISMS Sponsor Information Security Policy approved by ISMS Sponsor Commitment to ISMS changes and resource needs (Management review) Active participation of Top Management (as Role Owners, Document Owners, Risk Owners). See ownership info in Role definitions, e.g Head of IT
5.2 Policy	Information Security Policy
5.3 Organizational roles, responsibilities and authorities	Roles & Responsibilities Organization Chart RACI Chart
6.1 Actions to address risks and opportunities	Risk Assessment Methodology Risk Assessment / Risk Register Risk Treatment Plan
6.2 Information security objectives and planning to achieve them	KPI tracking
6.3 Planning of changes	ISMS Significant Change Events Version and approval history of documents Approval workflow for role assignments (Role owner - > deputy -> ISMS Sponsor) Ticket system ISMS Check Ticket system ISMS Change Mangement project with ISMS Change task template
7.1 Resources	Roles & Responsibilities Licenses for services that support the ISMS
7.2 Competence	Competencies listed in role definitions Security training evidence Onboarding checklist Read confirmations, e.g.Remote Work Policy read confirmation
7.3 Awareness	Security awareness training evidence Read confirmations, e.g. Information Security Policy read confirmation Joiner-Mover-Leaver Procedure
7.4 Communication	Communication plan
7.5 Documented information	Document control template List of core documents
8.1 Operational planning and control	Operational procedures
8.2 Information security risk assessment	Risk Assessment / Risk Register
8.3 Information security risk treatment	Risk Treatment Plan Statement of Applicability
9.1 Monitoring, measurement, analysis and evaluation	KPIs KPI Dashboard
9.2 Internal audit	Internal Audit report ISMS Schedule
9.3 Management review	Management Review minutes
10.1 Continual improvement	Internal Audit report Management Review minutes ISMS Schedule Ticket system ISMS Check Ticket system ISMS Change Mangement project with ISMS Change task template
10.2 Nonconformity and corrective action	CAPA Register