ISMS Document Management Procedure

Introduction

Purpose

The purpose of this document is to define the process for managing documents within dxw in order to:

• enable staff to produce, issue and update documents
• control retention of records, online storage and archiving of documents.

Scope

The procedure is mandatory for ISMS components (procedures etc) and recommended for other documents which require control (e.g. proposals to clients).

Document Management

Production

Documents within the ISMS are produced to a common format using Google Docs.  Some documents are developed and maintained in GitHub, others in the playbook.

Document control

The standard revision history facilities of Google Docs, the playbook and GitHub are used to control changes to documents. ISMS documents may also have a revision history block as part of the documents metadata. (see Documents Policy )

Document approval, issue, publication, update 

The Information Security Manager or the owner of a document authorises the issue and publication of approved documents through the standard read/write permissions of Google or the new google doc approval tool or the equivalent in the playbook or Git.

The document author is responsible for advising staff, by internal blog post or slack message, if the changes have any impact on operational practice.

Documents of external origin

External reference documents (e.g. product guides and specifications) should normally be accessed online e.g. from the supplier’s website.  If it is necessary for such documents to be stored locally on the dxw network the recipient is responsible for ensuring that the local version is kept up to date. 

Any external documents held in paper form are regarded as uncontrolled and users are responsible for checking that their contents are up to date.

Archiving

ISMS components and outputs (e.g. proposals, records) are retained for a minimum of seven years, unless agreed otherwise for a specific document type (e.g. for legal or contractual reasons).

The Playbook defines how confidential documents are to be disposed of.  Other records are destroyed at the discretion of the owner.

Last updated: 22 September 2026