ISO 27001 · clause 7.5

One phrase in the standard, two jobs in your company

“Documented information”
Documents

The rules. They tell people what to do.

For example
Policies, procedures, the scope statement
Approved
Versioned
Findable
Records

The proof. They show something happened.

For example
A completed access review, a training log, review minutes
Dated
Protected
Retained