ISO 27001 Annex A Evidence Guide

Three rules before the table

• Dated, attributable, from the system. A screenshot needs the system name and date visible; an export beats a screenshot; a report the auditor can regenerate beats both.
• Covering the period. Surveillance and recertification audits sample across the year. One access review from last month does not evidence a quarterly control.
• One artifact, many controls. The access review record below serves A.5.15, A.5.16, A.5.18, A.8.2 and A.8.3. Collect once, reference everywhere; the Statement of Applicability is where you record which artifact covers which control.

“Inherited” means the control is operated by your cloud provider and your evidence is their SOC 2 or ISO 27001 report plus your review of it (A.5.22). That covers most of A.7 for cloud-only companies, but never the office, the laptops or the people.

A.5 Organisational Controls (37)

Control	Name	Typical evidence
A.5.1	Policies for information security	Approved policy set with version, owner, approval date and the acknowledgement log; evidence of the last annual review.
A.5.2	Information security roles and responsibilities	RACI or role descriptions naming the ISMS owner, risk owners and system owners; org chart dated within the period.
A.5.3	Segregation of duties	Role matrix showing separated duties (request vs. approve, develop vs. deploy); compensating controls where separation is impossible.
A.5.4	Management responsibilities	Manager responsibilities in the policy; a sample of managers confirming policy briefings or onboarding sign-offs.
A.5.5	Contact with authorities	Contact list for regulators, law enforcement and the data protection authority, with the last review date.
A.5.6	Contact with special interest groups	Memberships or subscriptions (ISACs, vendor security bulletins, CERT feeds) and an example of information acted on.
A.5.7 (new 2022)	Threat intelligence	Threat intelligence sources, the review cadence, and a record of a threat that changed a control or priority.
A.5.8	Information security in project management	Project template or checklist with security requirements; a completed example from a project in the period.
A.5.9	Inventory of information and other associated assets	Asset inventory with owner, classification and location for information, systems, devices and SaaS; last reconciliation date.
A.5.10	Acceptable use of information and other associated assets	Acceptable use policy and acknowledgements; MDM or SaaS settings that enforce it.
A.5.11	Return of assets	Offboarding checklist showing device and badge return for a sample of leavers.
A.5.12	Classification of information	Classification scheme with levels and handling rules; examples of classified repositories.
A.5.13	Labelling of information	Labelling configuration (document labels, repository tags, email banners) or the documented decision not to label.
A.5.14	Information transfer	Transfer rules (approved tools, encryption, external sharing settings); sharing restrictions in the collaboration suite.
A.5.15	Access control	Access control policy; role definitions; access request records for a sample of grants.
A.5.16	Identity management	Identity provider as source of truth; joiner, mover and leaver records; no orphaned accounts in the last review.
A.5.17	Authentication information	Password and MFA settings in the identity provider; password manager rollout; process for initial credentials.
A.5.18	Access rights	Quarterly access review records with actions; provisioning tickets; leaver removal evidence with timestamps.
A.5.19	Information security in supplier relationships	Supplier security policy; vendor inventory with risk tier and owner.
A.5.20	Addressing information security within supplier agreements	Contract clauses or DPAs covering security, breach notification and audit rights for a sample of critical suppliers.
A.5.21	Managing information security in the ICT supply chain	Assessment of ICT suppliers (cloud, managed services, software components); SBOM or dependency inventory where relevant.
A.5.22	Monitoring, review and change management of supplier services	Annual supplier reviews: SOC 2 or ISO report review notes, SLA performance, change notifications.
A.5.23 (new 2022)	Information security for use of cloud services	Cloud service inventory; shared-responsibility documentation; configuration baselines; exit plan for critical services.
A.5.24	Information security incident management planning and preparation	Incident response plan with roles, severity levels and contacts; evidence it was communicated.
A.5.25	Assessment and decision on information security events	Triage criteria; event log showing events assessed and classified, including those closed as non-incidents.
A.5.26	Response to information security incidents	Incident records with timeline, containment, communication and closure for incidents in the period.
A.5.27	Learning from information security incidents	Post-incident reviews with actions and their closure; trend review in management review.
A.5.28	Collection of evidence	Evidence handling procedure (chain of custody, preservation); forensic readiness arrangements.
A.5.29	Information security during disruption	Business continuity plan with security requirements during disruption; test record.
A.5.30 (new 2022)	ICT readiness for business continuity	ICT continuity plan with RTO and RPO; DR test results against those objectives.
A.5.31	Legal, statutory, regulatory and contractual requirements	Register of legal, regulatory and contractual requirements with owner and review date.
A.5.32	Intellectual property rights	Software licence inventory; IP clauses in employment and supplier contracts.
A.5.33	Protection of records	Records retention schedule; protection of key records (backups, immutability, access restriction).
A.5.34	Privacy and protection of PII	Privacy notice, records of processing, DPIAs where required, DSR handling log.
A.5.35	Independent review of information security	Internal audit report or independent review by someone outside the ISMS team.
A.5.36	Compliance with policies, rules and standards	Compliance checks by managers or the security team (configuration reviews, policy spot checks) with findings.
A.5.37	Documented operating procedures	Runbooks and operating procedures for in-scope systems, version-controlled and current.

A.6 People Controls (8)

Control	Name	Typical evidence
A.6.1	Screening	Screening policy; evidence a background check was completed before start for a sample of hires.
A.6.2	Terms and conditions of employment	Employment contract template with security clauses; signed copies for sampled staff and contractors.
A.6.3	Information security awareness, education and training	Training completion records at onboarding and annually; training content outline.
A.6.4	Disciplinary process	Disciplinary process in the HR handbook; a record of use, or confirmation none was needed.
A.6.5	Responsibilities after termination or change of employment	Offboarding communication of continuing obligations; NDA clauses surviving termination.
A.6.6	Confidentiality or non-disclosure agreements	NDA template; signed NDAs for contractors and third parties with access.
A.6.7	Remote working	Remote working policy; device and network requirements enforced by MDM and zero-trust access.
A.6.8	Information security event reporting	Reporting channel for security events; examples of reports received and handled.

A.7 Physical Controls (14)

Control	Name	Typical evidence
A.7.1	Physical security perimeters	Office floor plan with secure areas marked; access control on perimeters. Cloud-only companies: provider report coverage.
A.7.2	Physical entry	Badge system records, visitor log, access list review for the server room or office.
A.7.3	Securing offices, rooms and facilities	Office security measures (locks, alarms, reception) and the provider’s SOC 2 for data centre facilities.
A.7.4 (new 2022)	Physical security monitoring	CCTV or alarm monitoring arrangements; review of alerts.
A.7.5	Protecting against physical and environmental threats	Fire, flood and power protections in offices; cloud provider facility controls inherited.
A.7.6	Working in secure areas	Procedures for secure areas (escorting, recording, no unauthorised devices).
A.7.7	Clear desk and clear screen	Clear desk and screen rules; screen lock timeouts enforced via MDM.
A.7.8	Equipment siting and protection	Equipment placement and protection in offices; cloud provider controls for hosted systems.
A.7.9	Security of assets off-premises	Laptop policy; full-disk encryption and remote wipe capability; loss reporting procedure.
A.7.10	Storage media	Media handling procedure; encrypted removable media or a documented ban; disposal records.
A.7.11	Supporting utilities	UPS or generator arrangements for offices if relevant; provider inheritance for hosting.
A.7.12	Cabling security	Cabling protection in offices; usually inherited for hosted environments.
A.7.13	Equipment maintenance	Maintenance records or vendor support contracts; provider inheritance.
A.7.14	Secure disposal or re-use of equipment	Device wipe or destruction certificates; disposal log.

A.8 Technological Controls (34)

Control	Name	Typical evidence
A.8.1	User end point devices	MDM compliance report: encryption, screen lock, patching, EDR on all end-user devices.
A.8.2	Privileged access rights	Privileged account inventory; just-in-time or PAM records; separate admin accounts with MFA.
A.8.3	Information access restriction	Role-based access configuration; data access restrictions in applications and databases.
A.8.4	Access to source code	Repository permissions; branch protections; review of who can push to production branches.
A.8.5	Secure authentication	MFA enforcement settings; SSO coverage; secure authentication for privileged and remote access.
A.8.6	Capacity management	Capacity monitoring dashboards; autoscaling configuration; capacity review in operations meetings.
A.8.7	Protection against malware	EDR deployment report; malware alert handling records.
A.8.8	Management of technical vulnerabilities	Vulnerability scan reports; remediation SLAs and compliance; penetration test report and fixes.
A.8.9 (new 2022)	Configuration management	Configuration baselines (hardened images, infrastructure as code); drift detection results.
A.8.10 (new 2022)	Information deletion	Retention and deletion schedule; evidence of deletion runs or customer data deletion on request.
A.8.11 (new 2022)	Data masking	Masking or pseudonymisation in non-production environments and analytics; configuration evidence.
A.8.12 (new 2022)	Data leakage prevention	DLP rules in email and collaboration tools, or a documented risk-based decision on scope.
A.8.13	Information backup	Backup configuration; restore test record; backup monitoring alerts.
A.8.14	Redundancy of information processing facilities	Redundant architecture (multi-AZ, replicas); availability objectives; failover test.
A.8.15	Logging	Log source inventory; retention settings; protection of logs from modification; access to logs restricted.
A.8.16 (new 2022)	Monitoring activities	Alert rules; monitoring coverage; sample alerts triaged and closed.
A.8.17	Clock synchronisation	NTP configuration across systems; cloud provider time sync.
A.8.18	Use of privileged utility programs	Restrictions on admin utilities and scripts; allow-listing or privileged access controls.
A.8.19	Installation of software on operational systems	Software installation restrictions on endpoints and servers; approved software list.
A.8.20	Networks security	Network diagram; firewall and security group rules; network device management.
A.8.21	Security of network services	Security requirements for network services (VPN, DNS, CDN, ISP) and their monitoring.
A.8.22	Segregation of networks	Segmentation evidence: separate accounts or VPCs, security groups between tiers.
A.8.23 (new 2022)	Web filtering	DNS or web filtering configuration, or a documented decision with compensating controls.
A.8.24	Use of cryptography	Cryptography policy; TLS configuration; KMS key management and rotation.
A.8.25	Secure development life cycle	Secure development policy; SDLC description; evidence it is followed in a sampled change.
A.8.26	Application security requirements	Security requirements in design documents or tickets for a sampled feature.
A.8.27	Secure system architecture and engineering principles	Architecture principles; design reviews for significant changes.
A.8.28 (new 2022)	Secure coding	Secure coding standard; static analysis in CI; developer training records.
A.8.29	Security testing in development and acceptance	Security tests in the pipeline (SAST, dependency scanning, DAST) and results; acceptance criteria.
A.8.30	Outsourced development	Contracts and oversight records for outsourced development; code review of delivered work.
A.8.31	Separation of development, test and production environments	Separate environments with separate credentials; no production data in test unless masked.
A.8.32	Change management	Change records with review, approval, testing and deployment evidence for a sample.
A.8.33	Test information	Test data policy; synthetic or masked data in test; access restrictions.
A.8.34	Protection of information systems during audit testing	Audit planning that limits read-only access and scheduling; agreed scope with auditors.

Using this with the SoA

Open the Statement of Applicability builder and switch on “Show typical evidence”: the same lines appear under each control so you can write the implementation summary with the artifact named. For the clause-level evidence (scope, risk assessment, internal audit, management review) see the ISO 27001 tab of the evidence checklists.

Do we need evidence for excluded controls?

Only the justification in the SoA. Auditors test the justification, not the control, so make it specific: what you do not have, and which control covers the residual risk.

How much evidence per control?

For a first certification, one current artifact per applicable control plus whatever shows the control has operated over the months before Stage 2. For periodic controls, every occurrence since the ISMS went live.

Get this as a document

Enter your name and work email and the full table is sent to you as a document.

Email me this resource

Name Work email Website Send it to me. We may follow up once. No spam, unsubscribe anytime (privacy).

Send it to me Save as PDF