For those geeks who just want to know what ISO27001 is all about in a nutshell.

ISO/IEC 27001 was completely rewritten and re-issued in September 2013.

Certification auditors will almost certainly check that these fifteen types of documentation are (a) present, and (b) fit for purpose.

The following mandatory documentation is explicitly required for certification:

1. ISMS scope (as per clause 4.3)
2. Information security policy (clause 5.2)
3. Information risk assessment process (clause 6.1.2)
4. Information risk treatment process (clause 6.1.3)
5. Information security objectives (clause 6.2)
6. Evidence of the competence of the people working in information security (clause 7.2)
7. Other ISMS-related documents deemed necessary by the organization (clause 7.5.1b)
8. Operational planning and control documents (clause 8.1)
9. The results of the [information] risk assessments (clause 8.2)
10. The decisions regarding [information] risk treatment (clause 8.3)
11. Evidence of the monitoring and measurement of information security (clause 9.1)
12. The ISMS internal audit program and the results of audits conducted (clause 9.2)
13. Evidence of top management reviews of the ISMS (clause 9.3)
14. Evidence of nonconformities identified and corrective actions arising (clause 10.1)
15. Various others:Annex A mentions but does not fully specify further documentation including the rules for
    1. acceptable use of assets,
    2. access control policy,
    3. operating procedures,
    4. confidentiality or non-disclosure agreements,
    5. secure system engineering principles,
    6. information security policy for supplier relationships,
    7. information security incident response procedures,
    8. relevant laws,
    9. regulations and contractual obligations plus the associated compliance procedures and information security continuity procedures.