Document Control Procedure

Purpose

This procedure defines how Maelstrom AI creates, reviews, approves, distributes, and retains documented information within the Information Security Management System (ISMS). It is designed to address the requirements of ISO 27001:2022 Clause 7.5 (Documented Information) in support of certification being pursued.

Scope

Applies to all ISMS documented information, including:

• Policies and procedures
• Risk assessments and treatment plans
• Statement of applicability
• Audit reports and findings
• Management review minutes
• Operational records (incident logs, access reviews, change records)
• Supporting evidence and checklists

Document Lifecycle

All ISMS documents follow a defined lifecycle:

1. Creation

• Author drafts the document in the provii-docs Git repository
• Documents are written in Markdown (.md or .mdx) with Starlight frontmatter
• Author assigns a document title, owner, classification, and version number
• Initial version is always 1.0

2. Review

1. Author creates a pull request (PR) in the provii-docs repository
2. Reviewer checks for accuracy, completeness, consistency with other ISMS documents, and correct use of ISO terminology
3. Review comments are recorded in the PR

3. Approval

1. ISMS Owner approves the PR
2. Approval is recorded as a PR review approval in GitHub
3. Approval constitutes formal authorisation to publish

4. Publication

1. PR is merged to the main branch
2. Automated deployment publishes to maelstrom.au/trust
3. Document becomes the current authorised version

5. Revision

• Any team member may propose changes via a new PR
• The same review and approval cycle applies
• Version number is incremented (e.g., 1.0 to 1.1 for minor changes, 1.0 to 2.0 for significant changes)
• Git history preserves the full change record

6. Obsolescence

1. When a document is no longer required, the ISMS Owner approves its removal
2. The document is removed from the published site via PR
3. Git history retains the document indefinitely for audit purposes

Version Control

Git-Based Control

All ISMS documents are stored in the provii-docs repository within our GitHub organisation. Git provides:

• Full version history. Every change is recorded with author, date, and description
• Change attribution. Each commit identifies who made the change and why
• Branching and review. All changes go through pull requests with mandatory review
• Immutable audit trail. Git commit history cannot be altered without detection

Version Numbering

Approval Workflow

1. Author creates a feature branch
2. Author commits changes and opens a PR
3. Reviewer examines the diff and provides feedback
4. ISMS Owner approves the PR
5. Author merges to main
6. Automated deployment publishes the updated document

Document Identification

Each document includes the following metadata:

Frontmatter (Top of Document)

• title. Document title
• description. Brief summary of document purpose
• section. Always security for ISMS documents
• group. Sidebar grouping (e.g., policies, operations, controls)
• order. Sidebar display order within the group
• icon. Visual indicator for navigation

Footer Metadata (Bottom of Document)

• Version. Current version number
• Effective Date. Date the current version took effect
• Owner. Role responsible for maintaining the document
• Review Frequency. How often the document is reviewed
• Next Review. Date of the next scheduled review
• Classification. Public, Internal, or Restricted

Master Document Register

The following table lists all ISMS documents currently maintained in the system.

Distribution and Access

Published Documentation

All ISMS documents with a Public classification are published to maelstrom.au/trust and are freely accessible.

Draft Documents

Documents under development exist in Git branches and are visible only to team members with repository access. Drafts are not published until merged to main.

Restricted Documents

Documents classified as Restricted (e.g., detailed key material locations, specific vulnerability assessments) are stored separately with access limited to authorised personnel. These are not published to the public documentation site.

Retention

• Current version. Always available on the published documentation site
• Prior versions. Retained in Git history for a minimum of 3 years
• Obsolete documents. Removed from the published site but retained in Git history for a minimum of 3 years
• Audit records. Retained per the Internal Audit Program requirements

Review Schedule

All ISMS documents are reviewed:

• Annually. At minimum, every 12 months from the effective date
• Upon significant change. When there is a material change to the ISMS scope, risk profile, organisational structure, or regulatory environment
• After incidents. When a security incident reveals gaps in documented procedures
• After audits. When audit findings indicate documentation is incomplete or inaccurate

The ISMS Owner is responsible for maintaining the review schedule and ensuring reviews are completed on time. Overdue reviews are escalated in the management review.

Related Documents

• Information Security Policy - Top-level policy governing ISMS
• Internal Audit Program - Audit of documentation completeness
• Management Review - Review of ISMS effectiveness including documentation
• Roles and Responsibilities - Document ownership roles

Document Information

• Version. 2.0
• Effective Date. 2026-02-13 (initial), 2026-02-16 (updated)
• Owner. ISMS Owner
• Review Frequency. Annually
• Next Review. 2027-02-16
• Classification. Public