When organizations start their ISO/IEC 27001 journey, one of the first questions that comes up is: “What documents are actually required for certification, and which ones are just nice to have?”
Let’s break it down.
The Mandatory Documents
ISO 27001 doesn’t demand binders full of policies. Instead, it requires key documents that prove your Information Security Management System (ISMS) is defined, risk-based, and continually improved. These include:
These documents are non-negotiable. An auditor will expect to see them, and noncompliance can result in a nonconformity (NC) being raised during your audit.
A nonconformity doesn’t automatically mean failure, but it does mean you’ll need to take corrective action.
Minor NCs may be cleared with additional evidence or process improvements, while major NCs can delay or even prevent certification until they’re resolved.
The Good-to-Have (But Not Mandatory)
Here’s where many organizations get tripped up. ISO 27001 does not explicitly require detailed technical or operational policies such as:
Do you need these for certification? Strictly speaking, no.
But in practice, they strengthen your ISMS and show alignment with Annex A controls.
They also reduce audit headaches, because documented policies make it easier to demonstrate that your processes are consistent, repeatable, and effective.
In summary, the mandatory documents form the essential foundation for ISO 27001 certification. While the additional policies are not compulsory, they serve as valuable enablers that demonstrate practical alignment with Annex A controls and provide clearer evidence of consistent, effective information security management to both auditors and internal stakeholders.
