7.5.3.1、应控制质量管理体系和本标准所要求的形成文件的信息，以确保：

a.在需要的场合和时机，均可获得并适用；

b.予以妥善保护（如：防止失密、不当使用或不完整）。

7.5.3.2、为控制形成文件的信息，适用时，组织应进行下列活动：

a.分发、访问、检索和使用；

b.存储和防护，包括保持可读性；

c.更改控制（如版本控制）；

d.保留和处置。

e.如果为了任何目的需保留，应通过清除，进行适当的标识或者控制，以防止作废的形成文件的信息的非预期使用，

对于组织确定的、策划和运行质量管理体系所必需的、来自外部的形成文件的信息，组织应进行适当识别，并予以控制。

对所保留的作为符合性证据的形成文件的信息应予以保护，防止非预期的更改。

当形成文件的信息以电子化管理时，数据保护过程应定义（例如：保护以防丢失，非授权的更改，非预期变更，讹误，物理损坏）。

注：对形成文件的信息的“访问”可能意味着仅允许查阅，或者意味着允许查阅并授权修改。

7.5.3.1、Documented information required by the quality management system and by this International Standard shall be controlled to ensure:

a. it is available and suitable for use, where and when it is needed;

b. it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

7.5.3.2、For the control of documented information, the organization shall address the following activities, as applicable:

a. distribution, access, retrieval and use;

b. storage and preservation, including preservation of legibility;

c. control of changes (e.g. version control);

d. retention and disposition.

e. prevention of the unintended use of obsolete documented information by removal or by application of suitable identification or controls if kept for any purpose.

Documented information of external origin determined by the organization to be necessary for the planning and operation of the quality management system shall be identified as appropriate, and be controlled.

Documented information retained as evidence of conformity shall be protected from unintended alterations.

When documented information is managed electronically, data protection processes shall be defined (e.g., protection from loss, unauthorized changes, unintended alteration, corruption, physical damage).

NOTE Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.