Documented Information Register (ISO 42001 §7.5)

The Documented Information Register lives as the Documented Info (7.5) tab on /governance/aims-scope and is available to Professional and Enterprise tiers when the per-organization ISO 42001 toggle is enabled. It is an INDEX, not a parallel store — metadata about every controlled governance document, with a pointer back to where the content actually lives (Policy Library, AIMS module, SharePoint, etc.).

What you can record

Each entry captures the metadata required by ISO/IEC 42001:2023 Clause 7.5:

Doc code, title, description, version — identifiers and a short narrative.
Type — Policy, Procedure, Standard, Work Instruction, Record, Plan, Register, Report, Form / Template, External Document, Other (11 values).
Status — Draft → In Review → Active → Superseded → Retired (5-state lifecycle).
Confidentiality — Public / Internal / Confidential / Restricted.
Owner & approver — accountable person and the formal approver.
Storage location & external URL — where the content actually lives.
Linked module + record — backfill from Policy Library, AIMS Scope, Management Reviews, Internal/External Audit findings, Nonconformities, Improvements, Controls, Risks, Requirements, Monitoring Plans, Suppliers, Training, Attestations (15 targets).
Review cadence — Weekly, Monthly, Quarterly, Semi-Annual, Annual, or Custom interval days.
Mark Reviewed action rolls last_reviewed_at and computes next_review_duevia the canonical scheduling module.

Backfill from upstream registers

The Backfill button on the toolbar surfaces candidate documents already living in other registers — Policy Library, AIMS Scope statements, Management Review actions, Internal Audit findings, and Nonconformities — and lets you opt-in to register them in one step. Records already linked in the register are filtered out automatically (deduplication on linked_module + linked_id).

This never mutates the source records. It simply creates an INDEX entry that points back to them.

Review cadence

Active rows show a Due Soon warning band (default 30 days) and an Overdue band when past due. The "Due in N days" warning honours the per-row warning_days override; otherwise it falls back to the default. Cadence math is powered by the canonical scheduling module (src/lib/scheduling.ts) shared with the Dataset Registry, attestations, and scheduled reports.

Exports

CSV — RhindonCyber_DocumentedInformation_<date>.csv (full register, 21 columns).
DOCX — RhindonCyber_DocumentedInformation_<date>.docx (branded register snapshot with KPI summary + entries table).

Both write a DOCINFO_EXPORTED entry to the org and Platform Activity Log.

Auditing & access

All actions write immutable entries to the org and Platform Activity Log:

DOCINFO_REGISTERED — new entry created (manual or via backfill).
DOCINFO_UPDATED — any field edit.
DOCINFO_REVIEWED — Mark Reviewed action; auto-rolls next_review_due forward.
DOCINFO_SUPERSEDED — replaced by a newer version.
DOCINFO_RETIRED — taken out of force; record retained for audit trail.
DOCINFO_EXPORTED — CSV or DOCX export.
DOCINFO_LINKED — linked to (or unlinked from) an upstream register record.

Access is tenant-isolated via row-level security and additionally gated by tier and the ISO 42001 org toggle.