Skip to content

Procedure for the Control of Documented Information

Purpose. Defines how Soon creates, approves, versions, distributes, protects and retains the documented information of the ISMS (ISO/IEC 27001:2022 clause 7.5). Mandatory. At Soon this is largely implemented by the repository and its tooling — this procedure describes that system.

1. Where documented information lives

All ISMS documents are Markdown in the Git repository SoonHQ/isms. main is the single authoritative ("live") version. Records/evidence that are too sensitive for the repo are referenced from documents but held in a separate access-controlled store (see §6).

2. Creating & identifying documents (7.5.1 / 7.5.2)

  • Each document is created from docs/_templates/policy-template.md and carries YAML front-matter: doc_id, title, type, status, version, owner, classification, review_frequency, next_review, control mappings.
  • IDs follow the scheme in ROADMAP.md; titles are descriptive.
  • tools/isms.py check enforces that required metadata is present and valid.

3. Review & approval (7.5.2)

  • Documents progress template → draft → in-review → approved (the status field).
  • All changes are made on a branch and merged to main via a Pull Request, reviewed per CONTRIBUTING.md and CODEOWNERS.
  • A document is approved only by its owner/top management, recording approved_by, approved_date and next_review. Only approved documents count for certification.

4. Version control & change history (7.5.3)

  • Git provides full, immutable version history, authorship and diffs — every change is traceable. The current version is the document's version field on main.
  • Superseded documents are marked status: superseded (history remains in Git).
  • The live Document Register and STATUS dashboard are auto-generated by tools/isms.py and refreshed on merge.

5. Distribution, access & protection (7.5.3)

  • Access is via GitHub with least privilege: Soon team = Write, external consultant = scoped Write, auditor = Read-only. The repo is private.
  • Classification (Public/Internal/Confidential/Restricted) is recorded per document.
  • A read-only website (MkDocs, behind Cloudflare Access) may be published for reading/audit — see hosting & deploy.

6. Records, evidence & retention

  • Records (audit reports, review minutes, incident records, CAPA log) are documented information too and are version-controlled here unless sensitive.
  • Sensitive evidence (containing personal data/secrets) is not stored in this repo. It is captured to a hardened AWS S3 evidence store (eu-west-1, versioned + Object Lock/WORM + encrypted) and indexed from here — see the Evidence Collection and Management Procedure (ISMS-DOC-07-7) and the Evidence Register (ISMS-FORM-07-2). The repo keeps only the index and chain-of-custody manifests.
  • Retention periods follow the Records Retention and Protection Policy (A.5.33). Resolved 2026-08-13: customer data is deleted 90 days after contract end, ISMS records are kept 3 years, and the evidence store enforces that with S3 Object Lock (Governance, 1095 days) in the log-archive account 404379474355. (Formerly: align the S3 Object Lock period to it.

7. Control of external documents

Externally-originated documents needed by the ISMS (e.g. supplier DPAs, the ISO standard, regulatory texts) are identified and access-controlled by the ISM.

Change log

Version Date Author Comments
0.1 2026-06-25 Andrea Cardinali / ISMS First draft — documents the repo + tooling as Soon's documented-information control system.
0.2 2026-07-12 ISMS §6 — named the S3 evidence store and linked the new Evidence Collection & Management Procedure (07-7) and Evidence Register (07-2); kept retention-schedule TODO.