{"id":4430,"date":"2015-01-12T19:19:52","date_gmt":"2015-01-12T19:19:52","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/blog\/015\/01\/12\/explanation-of-the-basic-terminology-in-iso-standards\/"},"modified":"2025-07-10T09:40:30","modified_gmt":"2025-07-10T09:40:30","slug":"explanation-of-the-basic-terminology-in-iso-standards","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2015\/01\/12\/explanation-of-the-basic-terminology-in-iso-standards\/","title":{"rendered":"Explanation of the basic terminology in ISO standards"},"content":{"rendered":"

Updated 2015-12-11: Number of mandatory clauses<\/em><\/p>\n

When I deliver various trainings for ISO 27001<\/a>\u00a0and ISO 22301<\/a>, it always turns out that one of the hottest topics is about which policies and procedures need to be documented, and which do not.<\/p>\n

Of course, there are some other heated discussions as well, but many of those happen because for someone new in the ISO world (not only in ISO 27001 and ISO 22301, but also in ISO 9001<\/a>, ISO 14001<\/a>, ISO 20000<\/a>, etc.) it is not easy to understand some specific wording in those standards \u2013 here is the explanation of the terms that cause the most common doubts.<\/p>\n

Which policies and procedures need to be documented?<\/h2>\n

When you see the words policy<\/em> or procedure<\/em> in an ISO standard, this does not mean that such a document needs to be written. A policy or a procedure needs to be written only if the word documented<\/em> stands next to it.<\/p>\n

For example, Access control policy<\/a>\u00a0from ISO 27001 control A.9.1.1 needs to be written down because the control says \u201c\u2026 policy shall be established, documented<\/em>, and \u2026.\u201d As opposed to that,\u00a0Backup policy<\/a>\u00a0does not to be written down because in control A.12.3.1 of ISO 27001 there is no mention of the word documented<\/em>.<\/p>\n

Why do ISO standards mention the words policy<\/em> or a procedure<\/em> if they don\u2019t need to be documented? Because a policy or a procedure could also be expressed verbally, without writing it down. For example, you can define a simple procedure (like answering the phone) quite precisely by verbally agreeing with all participants on how it needs to be done \u2013 you don\u2019t need to write a document for it. Also, some policies can be a part of the information systems configuration (e.g., the password policy<\/a>) without having a separate document for it.
\n

<\/div>