The organization shall maintain documented information required by the standard and needed for ISMS effectiveness, and control it.
What this means in practice: Treat ISMS documentation as controlled assets—keep it accurate, protected, accessible, and managed across its lifecycle.
To make this concrete, the organization must ensure:
a. Documents are identified, reviewed/approved, kept current, and available where needed.
b. Information is protected (confidentiality/integrity/availability), including access control and backups.
c. Retention and disposal follow defined rules (legal/contractual/operational needs).
