# Clause 7.5.3: Control of documented information

Keep control of the documented information the BCMS and the standard call for, so that it can be found and used where and when it is needed and is properly protected. This covers how it is distributed, accessed, retrieved and used; how it is stored and preserved, legibility included; how changes are controlled; and how long it is kept and how it is disposed of. Documented information that comes from outside but on which the BCMS relies must also be identified and controlled.

Cloud: Control of documented information means the right version is available to the right people at the wrong moment's speed. Store the provider schedules and exit plans where the incident desk can reach them offline.

Evidence: Access and distribution controls with evidence of enforcement; Storage and preservation arrangements including offline or alternate site availability; Version control history and retention and disposition schedule; Register of controlled external origin documents.

Test: Check the incident desk can reach the current plan and contract when the provider portal is down.

Citation: ISO 22301:2019, clause 7.5.3. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.