Document Control Procedure

Purpose

This procedure defines the requirements for creating, reviewing, approving, distributing, revising, and retiring all documents within Carriyo's Information Security Management System (ISMS). It ensures that ISMS documentation is controlled, current, and accessible to authorized personnel, and that obsolete versions are properly managed.

Scope

This procedure applies to all ISMS documentation, including but not limited to:

• Policies (e.g., Information Security Policy, Access Control Policy)
• Procedures (e.g., Incident Response Procedure, Change Management Procedure)
• Records (e.g., audit reports, risk assessments, management review minutes)
• Forms and templates (e.g., risk register templates, access request forms)
• Supporting documents (e.g., network diagrams, asset inventories)

All Carriyo employees, contractors, and third parties who create, review, or use ISMS documentation are subject to this procedure.

Document Identification Scheme

All ISMS documents are assigned a unique identifier following the format:

CAR-ISMS-[TYPE]-[SEQ]

Where:

• CAR identifies Carriyo as the organization.
• ISMS identifies the document as part of the Information Security Management System.
• TYPE identifies the document category (POL, PRC, REC, or FRM).
• XXX is a three-digit sequential number (001, 002, 003, etc.).

Numbering Rules

• Numbers are assigned sequentially within each type category.
• Once assigned, a document ID is never reused, even if the document is retired.
• The Master Document Register (see below) is the authoritative source for all assigned document IDs.
• Supplementary or supporting documents that fall outside the four main types may use the prefix CAR-ISMS-SUP-XXX.

Document Lifecycle

Every ISMS document passes through the following lifecycle stages:

1. Creation

• Any authorized person may draft a new ISMS document.
• The document must follow the approved ISMS document template.
• The author assigns a document ID from the next available number in the relevant category.
• All new documents must include complete frontmatter metadata: title, description, ISO control mappings, status (set to "draft" initially), and order number.
• The author registers the document in the Master Document Register immediately upon creation.

2. Review

• All documents must be reviewed before approval.
• The Document Owner (Information Security Specialist) conducts an initial review for completeness, accuracy, and alignment with ISO 27001:2022 requirements.
• Technical reviewers may be engaged for domain-specific content (e.g., engineering leads for SDLC policies).
• Review comments are tracked and resolved before the document proceeds to approval.

3. Approval

• The CISO is the sole and final approver for all ISMS documents.
• Approval is recorded in the Master Document Register with the approval date.
• No ISMS document may be published or distributed without CISO approval.
• Upon approval, the document status changes from "draft" to "active".

4. Distribution

• Approved documents are published to the Carriyo Security Portal (the store of record).
• The Security Portal is the single source of truth for all active ISMS documents.
• Documents are made available as MDX files within the portal, where they can be viewed, searched, and downloaded.
• Internal staff are notified of new or significantly revised documents via appropriate communication channels (e.g., Slack, email).
• Distribution of controlled copies outside the portal is discouraged. If physical or offline copies are required, they must be watermarked as "Uncontrolled Copy" and reference the portal as the authoritative source.

5. Revision

• Documents may be revised at any time to reflect changes in the organization, technology, regulations, or threat landscape.
• All revisions follow the same review and approval process as new documents.
• The version number is incremented according to the Version Control rules below.
• The previous version is archived and retained per the Records Management section.
• The Master Document Register is updated with the new version number, revision date, and next review date.

6. Retirement

• Documents that are no longer applicable are formally retired.
• Retirement requires CISO approval.
• Retired documents are removed from the active section of the Security Portal.
• Retired documents are retained in the archive for a minimum of 3 years from the date of retirement.
• The Master Document Register is updated to reflect the "Retired" status with the retirement date.

Version Control

ISMS documents use a major.minor versioning scheme:

Version Control Rules

• All documents begin at version v1.0 upon initial approval.
• Draft documents prior to first approval are labeled v0.1, v0.2, etc.
• Major version increments reset the minor number to zero (e.g., v1.3 → v2.0).
• Every version change must be accompanied by a brief change description in the Master Document Register.
• The Security Portal always displays the current active version. Previous versions are retained in the archive.

Approval Authority

Delegation

• The CISO may delegate approval authority in writing for specific documents or during periods of absence.
• Any delegation must be recorded and time-bound.
• The Document Owner may not approve their own documents.

Review Schedule

Annual Review

• All ISMS documents must be reviewed at least once every 12 months from the date of last review.
• The Document Owner maintains a rolling review calendar and initiates reviews at least 30 days before the review due date.
• The review must assess whether the document remains accurate, complete, and aligned with current operations, technology, and regulatory requirements.

Event-Triggered Reviews

In addition to the annual cycle, documents must be reviewed when any of the following events occur:

• Organizational changes — mergers, acquisitions, restructuring, or significant staffing changes
• Technology changes — new systems, platforms, or infrastructure changes that affect security controls
• Regulatory or legal changes — new laws, regulations, or contractual obligations affecting information security
• Security incidents — incidents that reveal gaps or deficiencies in existing documentation
• Audit findings — internal or external audit findings that identify documentation deficiencies
• Risk assessment changes — significant changes to the risk register or risk treatment plan
• ISO 27001 standard updates — changes to the ISO 27001 standard or its Annex A controls
• Management direction — specific requests from the CISO or executive management

Overdue Reviews

• Documents that have not been reviewed within 12 months are flagged as "overdue" in the Master Document Register.
• The Document Owner escalates overdue reviews to the CISO on a monthly basis.
• Documents more than 3 months overdue may be suspended from active use pending review.

Distribution and Access

Master Copies

• The Carriyo Security Portal is the official store of record for all active ISMS documents.
• Documents are stored as MDX files in the portal's content directory and rendered through the portal's web interface.
• The portal provides search, browsing, and download capabilities for all authorized users.

Access Control

• All Carriyo employees have read access to active ISMS documents through the Security Portal.
• Write access to the document repository is restricted to the Document Owner and authorized administrators.
• Changes to documents in the repository must go through the standard review and approval process.
• External parties (auditors, customers, partners) may be granted access to specific documents on a case-by-case basis with CISO approval.

Uncontrolled Copies

• Any document accessed outside the Security Portal is considered an uncontrolled copy.
• Uncontrolled copies are not subject to automatic updates and may become outdated.
• Recipients of uncontrolled copies are responsible for verifying the current version on the portal.

Records Management

Retention

Disposal

• Documents that have exceeded their retention period may be permanently deleted.
• Disposal requires CISO approval.
• A disposal record is maintained noting the document ID, title, version, retention expiry date, and disposal date.
• Disposal of electronic records must follow secure deletion practices consistent with Carriyo's Data Protection Policy.

Master Document Register

The Master Document Register is the authoritative index of all ISMS documents. It is maintained as a structured JSON file at:

/content/document-register.json

The register contains the following information for each document:

• Document ID — Unique identifier per the identification scheme
• Title — Full document title
• Type — Policy, Procedure, Record, or Form
• Version — Current version number
• Status — Active, Draft, Retired, or Suspended
• Owner — Document owner
• Approver — Approving authority
• Created Date — Date the document was first created
• Last Reviewed — Date of the most recent review
• Next Review Date — Date by which the next review must be completed
• ISO Controls — Mapped ISO 27001:2022 clauses and Annex A controls
• Storage Location — Path to the document on the Security Portal or other location
• Notes — Additional context or remarks

The Document Owner is responsible for keeping the Master Document Register accurate and up to date at all times. Any change to a document's status, version, or metadata must be reflected in the register within 24 hours.

Compliance

This procedure supports Carriyo's compliance with:

• ISO 27001:2022 Clause 7.5.1 — Documented information: General
• ISO 27001:2022 Clause 7.5.2 — Creating and updating documented information
• ISO 27001:2022 Clause 7.5.3 — Control of documented information

Enforcement

Failure to follow this procedure may result in:

• Documents being rejected during internal or external audits
• Non-conformities raised against the ISMS
• Disciplinary action for repeated or willful non-compliance

All personnel are expected to familiarize themselves with this procedure and follow it when creating, modifying, or distributing ISMS documents.