SG-03—Document Control

>Control Description

Organization's document management criteria is periodically reviewed, approved by management, and communicated to authorized personnel; management determines the treatment and retention of documentation according to legal and regulatory requirements.

Theme

Process

Type

Preventive

Policy/Standard

Information Security Management Standard

>Implementation Guidance

1. Ensure that the organization has a well defined and documented document management criteria. 2. Ensure that the criteria is reviewed and approved by the management periodically. 3. Ensure that the criteria is communicated to authorized personnel. 4. Ensure that the documentation is treated and retained according to legal and regulatory requirements.

>Testing Procedure

1. Inspect the organization's policy and/or standard to validate that the organization has a well defined and documented document management criteria. 2. Validate that the criteria is reviewed and approved by the management periodically. 3. Validate whether the criteria is communicated to authorized personnel. 4. Validate for a sample documentation that it is treated and retained according to legal and regulatory requirements.