Where the Evidence Lives: Matching ISO 27001 Clauses to Records
Every clause of ISO/IEC 27001 has evidence somewhere, and it is often not where the organisation offers it. This page maps each clause to the records that evidence it, who is likely to hold them, and what the record actually has to show — because a document that exists is not the same as a requirement that is met.
Every clause of ISO/IEC 27001 has evidence somewhere, and it is often not where the organisation offers it. This page maps each clause to the records that evidence it, who is likely to hold them, and what the record actually has to show — because a document that exists is not the same as a requirement that is met.
Three principles before the ISO 27001 evidence table
Ask the person who does the work, not the person who owns the document. The document owner will show you the approved version. The person doing the work will show you the version they use, and the difference between the two is where findings live.
A document is a claim; a record is evidence. A procedure says what should happen. A record says what did. Where a clause requires documented information, establish which of the two you are being shown.
Choose your own sample. An organisation that offers you three records has chosen three it can defend. Take the register and pick.
ISO 27001 Clause 4 — context and scope
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 4.1 issues | The context or issues analysis; management review records | Information security manager | Issues determined, and revisited when the organisation changed |
| 4.2 interested parties | The interested party analysis; a sample of customer contracts; regulatory correspondence | Security manager, legal, account management | Parties, their relevant requirements, and which the ISMS will address |
| 4.3 scope | The scope statement, and the reasoning behind it | Security manager | The three considerations, especially interfaces and dependencies with other organisations |
| 4.4 the ISMS | A process map or equivalent | Security manager | The processes needed and how they interact |
The evidence that is not a document: ask someone in a scoped team to describe a normal working day, then read the scope statement against what they said. A scope is tested by what it has to account for, not by how it is worded.
ISO 27001 Clause 5 — leadership
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 5.1 commitment | Management review records; budget and headcount decisions; the risk treatment plan’s progress | Top management, finance, security manager | That determinations about what the ISMS needed were acted on |
| 5.2 policy | The approved policy; evidence of communication; a sample of customer requests for it | Security manager, account management | All seven elements, including availability to interested parties as appropriate |
| 5.3 roles | Role descriptions, terms of reference, the reporting line for ISMS performance | HR, security manager | Assigned and communicated, including who reports performance to top management |
The evidence that is not a document: ask a manager two levels down who is accountable for information security and what they would do with a serious concern.
Preparing for the PR373 exam?Full-length mock exams and exam application support are included.
ISO 27001 Clause 6 — planning
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 6.1.1 | The record of risks and opportunities for the ISMS itself, and the actions planned | Security manager | Something other than the information security risk register |
| 6.1.2 | The documented risk assessment method; the risk register | Security manager, risk owners | Criteria including acceptance criteria, and results that are comparable across the organisation |
| 6.1.3 d) | The Statement of Applicability | Security manager | Four things, and they are commonly collapsed into two: the necessary controls; the justification for including each one; whether each is implemented; and the justification for excluding any Annex A control |
| 6.1.3 e) | The risk treatment plan | Security manager, treatment owners | How identified risks will be treated, with owners and dates |
| 6.1.3 f) | Approval of the risk treatment plan and acceptance of the residual risks | Risk owners | Both limbs of f), dated — approval of the plan is not the same act as acceptance of what is left |
| 6.2 | The objectives register and the plans behind each objective | Security manager, objective owners | What, resources, who, when, and how results are evaluated |
| 6.3 | Records of changes to the ISMS — scope versions, method changes, restructures | Security manager | That the change was planned, not that it happened |
The evidence that is not a document: take one objective from the register and ask the person who owns it how they will know at the end of the year whether it was met. Clause 6.2 requires objectives to be monitored and the method of evaluation planned; the answer tells you whether either has happened.
ISO 27001 Clause 7 — support
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 7.1 resources | Resource requests and what happened to them | Security manager, finance | Requests made and met, or made and refused |
| 7.2 competence | The competence requirement for a role, then the records for people in it | HR, line managers, contract managers | The requirement and the evidence — records alone answer half |
| 7.3 awareness | Nothing. Ask a person | Anyone outside the security function | That they know the policy’s purpose and the implications of not conforming |
| 7.4 communication | The communication plan; a real external communication about an incident | Security manager, communications | On what, when, with whom and how — determined in advance |
| 7.5.1 | The list of documented information the organisation holds for the ISMS, and how it decided what else was necessary | Security manager | Both limbs: what the standard requires by name, and what the organisation itself determined it needed |
| 7.5.2 | One newly issued document, and the record of how it was produced | Document owner | Identification and description, format and media, and review and approval for suitability and adequacy |
| 7.5.3 | The document register; then the copy in use at a desk; then the external documents the ISMS relies on | Document owner, then the person doing the work | That the controlled copy is the one in use, and that external-origin documents are identified and controlled |
Want structured preparation?One year of LMS access and HD recordings come with the course.
ISO 27001 Clause 8 — operation
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 8.1 criteria | The stated criteria for a process the ISMS depends on, then records of it running | Process owners | Criteria exist and the process was controlled in accordance with them |
| 8.1 external provision | How one externally provided service relevant to the ISMS is controlled | Procurement, service owners | Something the organisation does, not only a contract clause |
| 8.2 | Retained risk assessment results, with dates | Security manager | Assessments performed at planned intervals or when a significant change was proposed or occurred — with dates showing which trigger applied |
| 8.3 | Retained results of risk treatment | Treatment owners | That plan items were done, with evidence, not that they were scheduled |
The evidence that is not a document: pick three controls the Statement of Applicability marks implemented and go and watch them operate on a live record.
ISO 27001 Clauses 9 and 10 — evaluation and improvement
| Requirement | Ask for | Usually held by | What it has to show |
|---|---|---|---|
| 9.1 | The measurement plan, the results, and the analysis and evaluation of them | Security manager, measure owners | Conclusions, not just numbers |
| 9.2.1 | The audit reports themselves, read for what they concluded rather than for what they covered | Internal audit | Information on conformity to the organisation’s own requirements for its ISMS, conformity to the standard, and effective implementation and maintenance — three things, and reports often deliver only the first |
| 9.2.2 | The audit programme, the reports, and the auditors’ independence from what they audited | Internal audit, security manager | Frequency, methods, responsibilities, planning requirements and reporting; objectivity and impartiality |
| 9.3.1 | The dates of reviews held, against the planned interval | Secretariat | Reviews at planned intervals, with top management present |
| 9.3.2 | Management review records for at least two cycles | Top management, secretariat | Every listed input, and decisions in the output |
| 9.3.3 | The output section of the same records | Secretariat, top management | Decisions on continual improvement and on any need for change to the ISMS — decisions, not notes |
| 10.1 | Version histories: the scope, the method, the objectives, the Statement of Applicability | Security manager | That something in the ISMS has changed for the better, and why |
| 10.2 | The nonconformity log from every source; then the entries marked closed | Security manager, quality function | Correction, evaluation of cause, action implemented, effectiveness reviewed |
The records ISO/IEC 27001 requires by name
Useful as a first sweep. Their absence is a finding; their presence proves only that a document exists.
| Documented information | Clause |
|---|---|
| ISMS scope | 4.3 |
| Information security policy | 5.2 |
| Risk assessment process, and its results | 6.1.2 and 8.2 |
| Risk treatment process, and its results | 6.1.3 and 8.3 |
| Statement of Applicability | 6.1.3 d) |
| Risk treatment plan | 6.1.3 e) |
| Information security objectives | 6.2 |
| Evidence of competence | 7.2 |
| Whatever the organisation determines is necessary | 7.5.1 |
| Records evidencing that ISMS processes were carried out as planned | 8.1 |
| Monitoring and measurement results | 9.1 |
| The internal audit programme and its results | 9.2.2 |
| Management review results | 9.3.3 |
| Nonconformities, actions taken, and results of corrective action | 10.2 |
Not sure about the course yet?One year of free retraining on the same exam version is included.
Evidence for the ISO 27001 Annex A controls
The clause table above covers the management system. Controls are audited differently, because each has its own natural evidence, and the pattern repeats across all four themes.
| Kind of control | The document | The record | The observation |
|---|---|---|---|
| Access control (A.5.15 to A.5.18, A.8.2, A.8.3) | The access control policy, and whatever procedure states how entitlements are granted, changed and withdrawn | Access request approvals; the results of an access review | An actual account list for a system you chose, read against a current staff list |
| People (A.6.x) | The screening policy, the terms of employment and the awareness programme | Screening records; training completion records; disciplinary process records | What a newly appointed member of staff can tell you about their own obligations, unprompted |
| Supplier and cloud (A.5.19 to A.5.23) | The supplier security requirements and the contract terms | A completed supplier assessment; monitoring or review records | What the service owner actually does when the supplier reports a problem |
| Incident management (A.5.24 to A.5.28) | The incident procedure and its severity definitions | The incident log, and one incident followed end to end | How an incident was assessed and decided, from the record rather than the procedure |
| Physical (A.7.x) | The physical security policy; visitor rules | Access logs; visitor books; maintenance records | A walk through the building — often the most productive hour of a site visit |
| Technological (A.8.x) | Standards, baselines and operating procedures | Configuration records, logs, test results, change records | The live configuration of one system you named |
The pattern is the same everywhere. The document tells you what the organisation committed to, and it becomes part of the audit criteria. The record tells you what happened. The observation tells you what is true now. A control evidenced only by its policy has not been audited.
Four kinds of ISO 27001 audit evidence, and what each is worth
Not all evidence carries the same weight, and knowing the order saves argument.
- What you observe. A screen, a room, a process running. Strongest, because nobody prepared it.
- Records. What happened, dated. Strong, provided you chose the sample.
- Documents. What should happen. They establish the organisation’s own criteria, which is valuable, but they are not evidence that anything occurred.
- Statements. What someone says. A lead worth following, and evidence only once corroborated.
A finding built on a statement alone will not survive the closing meeting. A finding built on an observation and a record will.
If you are being audited against ISO 27001 rather than auditing
The same map read from the other side. The organisations that have easy audits are not the ones with the most documents. They are the ones that can produce, for any clause, a record showing the thing happened, with a date and a person.
Three preparations are worth more than a manual: know where each item in the table above lives and who will produce it; make sure the people doing the work are using the controlled versions; and have the Clause 9 records in order, because they are the fastest way to show a system that finds and fixes its own problems.
ISO 27001 evidence finder: what do you ask for?
Pick a requirement and see which record to ask for, who holds it and what it has to show.
How to use it: Choose the option that fits you from the list. The answer appears below.
From the evidence tables in this article. A document is a claim; a record is evidence.
Frequently asked questions about ISO 27001 audit evidence
What documents does an ISO 27001 auditor ask for?
The ones the standard requires by name — scope, policy, risk assessment and treatment processes and results, Statement of Applicability, treatment plan, objectives, competence evidence, monitoring results, internal audit and management review records, nonconformity records — plus whatever the organisation itself determined was necessary.
What is the difference between a document and a record in ISO 27001?
A document says what should happen; a record says what did. The standard’s term for both is documented information, which is why establishing which one you are looking at matters.
Who should I interview for each ISO 27001 clause?
Rarely the security team alone. Risk owners for Clause 6, line and contract managers for competence, people at desks for awareness and document control, process owners for Clause 8, top management for Clause 9.3.
Is a policy enough evidence for an ISO 27001 control?
No. A policy establishes the organisation’s own criteria. Evidence that the control operates is a record or an observation.
How much should I sample in an ISO 27001 audit?
Enough to tell an isolated lapse from a pattern, and always chosen by you. Three records followed to the end are worth more than twenty read at one step.
Where to go next: more ISO 27001 Lead Auditor exam preparation
The clause map answers the other half of the question: which clause to cite once you have the evidence.
- Auditing Clause 8: operational planning and control
- Auditing Clause 9: monitoring, internal audit and management review
- Auditing Clause 10: nonconformity and continual improvement
3FOLD TRAINING is a CQI and IRCA Approved Training Partner, ATP number 6039853. Its ISO 27001 Lead Auditor training course is the CQI and IRCA Certified ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Training Course. The course identification number is PR373. Both the partner approval and the course certification are on 3FOLD TRAINING’s Approved Training Partner record, and any provider’s certified courses can be looked up in CQI and IRCA’s own directory of certified courses and approved training partners. The course page carries the schedule and what the course includes. If you would rather ask a person first, use the course enquiry form.
Booking a PR373 course? See the schedule, trainers and what’s included.
Leave a reply