7.5.1General - Documented information

The organization's information security management system shall include:

a) documented information required by this document; and

b) documented information determined by the organization as being necessary for the effectiveness

of the information security management system.

1) the size of the organization and its type of activities, processes, products, and services;

2) the complexity of processes and their interactions; and

3) the competence of persons.