Information security documents are requested in bulk before an audit and in reviews by customers. They are dense with technical terms, and a shift in the name of a single control may count as a non-conformity in the audit.
Policy document
It contains top management's commitment and the general framework. It is a short but binding text. A translation filled with general expressions is of no use in an audit.
Asset inventory
Hardware, software, data and personnel assets are listed. The owner and classification of each asset are stated. Classification names are kept fixed.
Information classification
Levels such as confidential, restricted and public are defined. Each level has its own handling rules. A shift in the level names invalidates all the rules.
Risk register
Threat, vulnerability, impact and likelihood are matched in a table. The risk score is calculated from these values. The explanation of the scale is given together with the table.
Selection of controls
The controls to be applied to the risks are determined. Control names come from the standard list and are not translated freely. The numbers are kept.
Statement of Applicability
Which control is applied, and the justification for any that is not, are stated. This document is among the first to be requested in an audit. The justification texts are not summarised.
Access management
Who will have access to which system and the procedure for granting rights are defined. Role names match the organisation. The match is kept in translation.
Passwords and authentication
The rules on complexity, expiry and multi-factor authentication are stated. Numerical values are carried over exactly. Loosening the rules creates a security vulnerability.
Backup policy
Backup frequency, retention period and recovery objectives are determined. The target times are referred to by abbreviations. The abbreviations are spelled out at first mention.
Incident response plan
The steps of incident detection, classification, response and closure are in sequence. The sequence is kept and the steps are not merged. The plan is read under pressure.
Chain of communication
Who informs whom, and when, is shown in a table. Time expressions may be in hours. This information determines the speed of response.
Breach notification
In personal data breaches a notification obligation arises. The notification text follows a template and the set form is kept. The time limits are strict.
Business continuity plan
Critical processes and their tolerances for disruption are determined. Recovery objectives are given numerically. The objectives are not rounded.
Supplier security
The security obligations of service providers are reflected in the contracts. The right to audit is regulated separately. This section matches the contract translation.
Awareness training
The content and frequency of the training given to employees are documented. Training material is a separate translation item. Terms are kept the same as in the policy.
Audit findings
Internal and external audit findings are matched to control numbers. The text of a finding is carried over exactly. The corrective action record is kept separately.
Penetration test reports
Technical test results are reported with vulnerability levels. The level names are standard. Technical details are not simplified.
Confidentiality level
These documents show the organisation's defence structure. In the wrong hands they turn into a map for an attack. Access is kept as narrow as possible and third-party services are not used.