This evidence guide is part of the ISO 27001 for startups roadmap. If you need to plan the work before collecting samples, read the realistic ISO 27001 implementation timeline first.
An ISO 27001 readiness assessment should do more than count completed policies. A useful question is whether your team can explain a security risk, show the control chosen to address it and produce evidence that the control works.
ISO 27001 sets requirements for an information security management system. The practical test below is a way to organise preparation; it is not a replacement for the standard or a certification audit. ISO 27001 overview.
Choose something your business recognises. For example, a former employee might retain access to customer information after leaving. Record the affected service, the information involved and the possible business impact.
Then identify the control you rely on. "We have an access policy" is incomplete. Who tells IT that the person has left? Which systems are covered? Who disables access, and how is completion checked?
For that example, prepare a link between the approved process, the triggering record, the removal action and the review of completion. Use a sample that reflects the actual environment, including important systems outside the central identity platform.
If the records disagree, investigate the cause. A timestamp might reflect a later administrative update, or access might genuinely have remained active. The purpose is to understand the control, not to tidy away an uncomfortable result.
| Question | Useful evidence to examine |
|---|---|
| Why does this control exist? | Relevant risk and treatment decision |
| What should happen? | Approved procedure and assigned responsibilities |
| What actually happened? | A real request, system record and completion evidence |
| Who checked it? | Review record and handling of exceptions |
| What changed after a failure? | Corrective action and evidence of follow-up |
Ask the control owner to walk through the example without the consultant answering every question. They do not need to memorise clause numbers. They should understand their responsibility, the evidence location and the action to take if the process fails.
Repeat the exercise for a production change, a supplier review and an incident or exercise. These are suggested preparation samples, not a prescribed audit sample size.
Separate missing documentation from controls that have not yet operated. A new procedure can be approved today; its operating evidence may require time and real activity. Your implementation plan should make that distinction visible.
For UK businesses seeking ISO 27001 consultancy, ask a provider how it will help with this connection between risk, operation and evidence. A large document pack is less useful when no one can explain how it reflects the business.
ProtectifyAI provides ISO 27001 readiness and implementation support. Bring one difficult control or evidence request to a working session, and we can help define the next step. For a wider assurance review, explore IT internal audit services.
Evidence should show that scoped controls operate in practice: access reviews, changes, incidents, backups, supplier reviews, risk treatment and management decisions.
The required period depends on the control, audit stage and certification body's sampling approach; start early enough to show repeatable operation rather than assembling records at the last minute.
Screenshots can support evidence, but dated system records, approvals, tickets and repeatable review records usually make the operating trail more credible.
We'll help you trace it from risk to evidence and identify what still needs work before audit week.
Book a working session →