Annex A: requirements, not guidance
Annex A is normative in ISO 30301:2019. It is where the operational requirements live: the records processes in A.1, the records controls in A.2 and the records systems in A.3. An auditor can cite it, and a gap analysis that stops at clause 8 is incomplete.
Annex A.1: Records processes
The organization has to operate the records processes its business needs and keep them under control.
Read the recordAnnex A.2: Records controls
The organization has to put in place the controls that make the records processes consistent across the organization.
Read the recordAnnex A.3: Records systems
The organization has to provide records systems that keep records authentic, reliable, usable and protected for as long as they are needed.
Read the recordThe rules this is built from
Every line names its source. The 25 clause-level records and the 3 Annex A records for the requirements that apply today are written from the published ISO 30301:2019, in our words; the evidence and the common gaps are our reading, cited to the clause. The revision layer is read from the public ISO stage record and the committee's published comparison. Where the record is silent, the page says so. Read from the real rules, not invented.
ISO 30301:2019, clause by clause
Each clause page states the requirement in our words, the evidence, the gaps and what to do before the revision lands.
Open the clause indexAnnex A, normative
Processes, controls and systems. Requirements, not guidance, and each one has its own page.
Open Annex AWhat changed in 2019
The committee's own comparison of the 2011 and 2019 editions, with the old clause and its new home.
Read the comparisonThe ISO 30301:2019 text is not reproduced. The ISO/PRF 30301 text is not public and is not reproduced. The record this site reads is linked on the standards page.