ISO 27001 evidence comes in two layers. Clauses 4 to 10 require specific documented information: the scope, the policy, the risk assessment and treatment results, the Statement of Applicability, the objectives, competence records, monitoring results, internal audit reports, management review minutes and corrective action records. Annex A controls are evidenced by records that they operated: access reviews, change approvals, backup tests, incident tickets, supplier assessments, training completions and system configurations. Auditors sample from populations across the period since the last audit, so evidence has to exist for the whole period, not for the week before the visit.
The question behind every Stage 2 and surveillance audit is the same: show me. This article lists what an ISO 27001 auditor asks to see, first the documented information the clauses require, then the operating evidence behind each group of Annex A controls, and finally what separates evidence that is accepted from evidence that produces a finding.
Two layers of evidence
The management system clauses produce records the standard names explicitly; the checklist lists them. The Annex A controls you declared applicable in the Statement of Applicability produce operational records whose form the standard leaves to you. The auditor works from the SoA: for each applicable control, which policy governs it, and what shows it operated.
Documented information by clause
- Clause 4: the scope statement; the register of issues and interested parties with their requirements.
- Clause 5: the approved information security policy; roles and responsibilities; evidence that top management is involved, such as review attendance and resource decisions.
- Clause 6: the risk assessment method and criteria; the risk register with owners; the risk treatment plan with the owners' approval of residual risk; the Statement of Applicability with versions; objectives and how they are measured; records of planned changes.
- Clause 7: competence records for people in ISMS roles; awareness training completions; the communication plan; document control showing versions, approvals and access.
- Clause 8: evidence that the risk treatment plan was executed; the results of each repeated risk assessment; records that operational processes ran as planned.
- Clause 9: monitoring and measurement results against the objectives; the internal audit programme, plans, reports and findings; management review minutes with the inputs the clause lists and the decisions taken.
- Clause 10: the nonconformity log; corrective actions with root cause, action, owner, date and the check that the action worked; evidence of continual improvement.
Operating evidence by control area
| Area | Controls | What auditors ask for |
|---|---|---|
| Organisation and governance | A.5.1 to A.5.8, A.5.31 to A.5.37 | Approved and acknowledged policies; segregation of duties matrix; contacts with authorities and groups; threat intelligence reviews; legal and contractual requirements register; independent review reports; operating procedures |
| Assets and classification | A.5.9 to A.5.14 | The asset inventory with owners and classification; acceptable use acknowledgements; return-of-assets records for leavers; labelling examples; rules for information transfer |
| Access and identity | A.5.15 to A.5.18, A.8.2 to A.8.5 | The access control policy; identity provider user list against the HR list; joiner, mover and leaver tickets; periodic access review records with decisions; privileged account inventory; MFA configuration; repository permissions |
| Suppliers and cloud | A.5.19 to A.5.23, A.8.30 | Supplier inventory with criticality; risk assessments and contract clauses; supplier certificates and reports reviewed; cloud service agreements and shared-responsibility decisions; monitoring and review records |
| Incidents and events | A.5.24 to A.5.28, A.6.8 | The incident response plan; the event and incident log with classification; incident tickets showing response and closure; lessons-learned records; evidence handling procedure |
| Continuity and backup | A.5.29, A.5.30, A.8.13, A.8.14 | Continuity and ICT readiness plans; recovery objectives; test results and the issues they raised; backup configuration and restore test records; redundancy design |
| People | A.6.1 to A.6.7 | Screening records per joiner; employment terms with security clauses; training completions; the disciplinary process; leaver checklists; signed confidentiality agreements; remote working rules |
| Physical | A.7.1 to A.7.14 | Site plans with perimeters and secure areas; entry logs and visitor records; monitoring arrangements; clear desk rules; equipment and media disposal certificates; or the provider's certification where sites are inherited |
| Operations and vulnerabilities | A.8.1, A.8.6 to A.8.12, A.8.15 to A.8.19 | Endpoint management status; capacity monitoring; malware protection coverage; vulnerability scan results and patch timelines against the policy; configuration baselines; deletion and masking records; logs and monitoring alerts; clock synchronisation; software installation rules |
| Networks and cryptography | A.8.20 to A.8.24 | Network diagrams and segregation; firewall and security group rules; network service agreements; web filtering configuration; the cryptography policy and key management records |
| Development and change | A.8.25 to A.8.29, A.8.31 to A.8.34 | The development life cycle; security requirements in tickets; code review and branch protection; test results including security testing; separated environments; change records with approval; test data rules; audit-test safeguards |
Populations and samples
An auditor does not read every record. For a control that runs repeatedly, they ask for the population since the last audit, such as every leaver, every production change or every quarterly review, and pick a sample. That is why a complete list matters more than a polished example: if the population is incomplete, the sample proves nothing, and a leaver who is missing from the list is a finding in itself. ISO/IEC 17021-1 and ISO/IEC 27006-1 set the audit-time and sampling expectations certification bodies follow.
What makes evidence acceptable
- Dated, so it can be placed inside or outside the period.
- Attributable to a person, a role or a system, so the auditor knows who did it.
- Drawn from the system of record, not retyped into a spreadsheet.
- Covering the period: a control that should run monthly needs twelve records, not one.
- Showing the decision, not only the artefact: an access review is a list plus the removals that followed, not a list alone.
- Consistent with the policy and the Statement of Applicability. Evidence of a control that the SoA excludes raises a different question.
Screenshots versus system evidence
Screenshots are accepted, with reservations: they show one moment, they are easy to stage, and they rarely carry a date or a source the auditor can verify. Exports and reports from the system itself, with their own timestamps, or records collected automatically from the system as the control ran, answer any sample date without a search. Auditors increasingly ask to see the live system during the interview, which no screenshot replaces.
How long to keep it
Clause 7.5.3 asks you to decide retention for documented information; nothing in the standard sets a period. In practice keep ISMS records for at least one full certification cycle, because the recertification audit reviews performance across the three years, and keep anything a law, a regulator or a contract requires for longer. The surveillance and recertification guide explains what each visit samples.
How Noru collects the evidence
Noru collects evidence continuously from the systems you connect, among them AWS, GCP, Azure, GitHub, Entra ID and Google Workspace, and maps each record to the controls it supports, so each control shows a current status and a dated history that covers the period. Controls no system can observe, such as most physical controls, are evidenced with uploaded documents. The audit package for a framework and period bundles the controls, their evidence, the policies and the Statement of Applicability for the certification body.
Primary sources
- ISO/IEC 27001:2022 — information security management systems, ISO
- ISO/IEC 17021-1:2015 — requirements for bodies providing audit and certification of management systems, ISO
- ISO/IEC 27006-1:2024 — requirements for bodies providing audit and certification of information security management systems, ISO