# ISO 27001 Evidence-Request Pack
*Published by Compliance Enablers LLP | complianceenablers.com*
*Last Updated: October 2026*

---

## Introduction

An ISO/IEC 27001 audit examines the evidence that your Information Security Management System (ISMS) is established, operating and improving (ISO/IEC 27001:2022, clauses 4–10). This Evidence-Request Pack is a generic list of the kinds of artefacts you may be asked to produce, organised by management-system clause and by Annex A theme. For each item it states the evidence requested and why an auditor may want it. Use it to run an internal readiness check, to brief control owners on what to prepare, and to assemble an evidence pack before your audit.

This is general information, not certification advice, and it does not reproduce the standard. Confirm the current requirements and control references with your certification body and your licensed copy of ISO/IEC 27001. There is no client, audit or engagement data in this pack.

---

## How Auditors Sample Evidence

A practical way to prepare is to assume a sample-based review: pick a handful of controls and follow the trail end to end — policy, procedure, evidence of operation and evidence of review. Evidence you can readily defend is:

- **Current** — recently dated.
- **Attributable** — you can show who did it.
- **Complete** — it covers the period under review.
- **Traceable** — it links back to the requirement or risk it satisfies.

Test each item below against those traits.

---

## Part 1 — Management-system clauses

### Context of the organisation (clause 4)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Documented ISMS scope statement | To confirm the boundaries of the ISMS and that they are deliberate and justified |
| List of interested parties and their requirements | To show you understand who relies on your ISMS and what they expect |
| Internal and external issues analysis | To demonstrate the ISMS is grounded in your actual context |

### Leadership (clause 5)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Information security policy approved by top management | To confirm leadership commitment and a mandate for the ISMS |
| Defined and communicated security roles and responsibilities | To show accountability is assigned, not assumed |
| Evidence of management engagement (meeting minutes, decisions) | To show leadership actively directs the ISMS |

### Planning (clause 6)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Risk assessment methodology and results | To confirm risks are identified and assessed consistently |
| Risk treatment plan | To show how risks are being addressed and by whom |
| Statement of Applicability (SoA) | To map each in-scope control to its applicability, justification and status |
| Information security objectives and plans to achieve them | To demonstrate the ISMS drives toward measurable goals |

### Support (clause 7)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Competence and training records | To confirm people doing security work are competent |
| Awareness programme evidence | To show staff understand their security responsibilities |
| Documented information control procedure (versioning, approval) | To show documents are controlled, current and approved |

### Operation (clause 8)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Evidence that planned processes are operating | To confirm the ISMS runs in practice, not just on paper |
| Records of risk assessments performed at planned intervals | To show risk is reassessed as the environment changes |
| Change management records | To demonstrate changes are controlled and assessed for risk |

### Performance evaluation (clause 9)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Monitoring and measurement results (metrics, KPIs) | To show ISMS effectiveness is measured |
| Internal audit programme, reports and findings | To confirm the ISMS is independently checked internally |
| Management review minutes and outputs | To show leadership reviews ISMS performance and acts on it |

### Improvement (clause 10)

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Nonconformity and corrective action records | To show issues are tracked to root cause and closure |
| Evidence of continual improvement | To demonstrate the ISMS improves over time |

---

## Part 2 — Annex A themes (ISO/IEC 27001:2022 Annex A)

Control references and titles come from your licensed copy. The categories below are examples of the evidence you may be asked to produce.

### Organisational theme — sample evidence

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Approved suite of security policies and review dates | To confirm policies exist, are approved and are kept current |
| Supplier security assessments and contract security clauses | To show third-party risk is managed |
| Incident register with classification and response records | To show incidents are detected, triaged and handled |
| Business continuity and ICT readiness test results | To demonstrate continuity is planned and exercised |
| Records retention and legal/regulatory requirements register | To confirm legal obligations are identified and met |

### People theme — sample evidence

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Background screening records (metadata, no sensitive PII) | To show new joiners are screened appropriately |
| Signed terms of employment and confidentiality agreements | To confirm security obligations are contractual |
| Awareness and training completion records | To show ongoing awareness is delivered and tracked |
| Joiner/mover/leaver access change records | To show responsibilities and access change with employment |

### Physical theme — sample evidence

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Physical access logs and visitor records | To confirm physical entry is controlled |
| Clear desk and clear screen policy and checks | To show information is protected in the workplace |
| Secure media handling and disposal records | To show media is protected and disposed of securely |

### Technological theme — sample evidence

| Evidence requested | Why an auditor may want it |
| --- | --- |
| Access reviews and privileged access records | To confirm access is least-privilege and reviewed |
| Multi-factor authentication configuration evidence | To show strong authentication is enforced |
| Vulnerability scan and patch management records | To show vulnerabilities are managed in time |
| Backup configuration and restore test evidence | To demonstrate backups exist and are recoverable |
| Logging and monitoring configuration and sample logs | To confirm security events are captured and reviewed |
| Encryption standards and key management records | To show cryptography is used and managed correctly |
| Secure development and code review records | To show security is built into development |

---

## Building Your Evidence Pack — A Checklist

- [ ] **Assemble management-system records** into a single, indexed pack before the audit.
- [ ] **Confirm the SoA reconciles** with the risk treatment plan.
- [ ] **Date-stamp every artefact** and remove anything stale or superseded.
- [ ] **Assign an owner** to each evidence item so the auditor can talk to the right person.
- [ ] **Dry-run a sample trail** — pick a control and follow it from policy to operating evidence.
- [ ] **Redact sensitive PII** from screening and personnel evidence; provide metadata only.
- [ ] **Capture the period of operation**, not just a point-in-time snapshot.

---

## How the Platform Supports Audit Readiness

Compliance Enablers runs ISO 27001 as one of 30 standards as guided programmes — scoping, assessment, scoring, evidence and readiness — with every dashboard module included in every plan. Controls, evidence and findings map across standards through thousands of curated crosswalk mappings, so evidence collected once counts everywhere it applies. An auditor portal is one of the eight portals for people outside the organisation; it lets you grant scoped, redacted access.

ISO 27001 is a licensed standard: it opens only after you confirm in-app that you hold your own licensed copy, and the platform works alongside your copy without selling or redistributing standard text. AI runs on Anthropic Claude for generation and OpenAI for embeddings; no customer data is used to train models, and every AI action is metered and visible to the customer.

---

*This resource is general information, not certification advice. Confirm the current standard text and audit requirements with your certification body and your licensed copy.*