A practical checklist to help teams understand what evidence auditors may expect during ISO 27001 readiness and audit preparation — covering policies, access reviews, MFA records, risk treatment, supplier management, and approval records.
Free download
See the types of evidence auditors commonly expect when reviewing ISO 27001 controls.
This checklist is designed for teams preparing for an ISO 27001 audit or building out their information security management system (ISMS). It is especially useful for:
If you are going through certification for the first time, this checklist gives you a clear picture of the evidence types auditors commonly request before you engage a certification body.
ISO 27001 requires annual surveillance visits. Use this checklist to verify your evidence pack is current, your controls have review dates, and approvals are documented.
If you are responsible for maintaining the ISMS, this checklist helps you identify gaps in evidence coverage before an internal or external review.
The checklist covers six evidence areas that auditors commonly review. Each item represents a concrete document, record, or approval that should exist in your ISMS.
Compliance managers, IT leads, and anyone responsible for preparing an ISO 27001 evidence pack. It is useful for teams approaching their first certification, preparing for a surveillance audit, or responding to an auditor's evidence request.
No. This checklist covers common evidence areas that auditors review, but it is not a complete representation of ISO 27001 requirements. Certification requires working with a qualified ISO 27001 consultant and an accredited certification body.
The M365 compliance checklist focuses on specific Microsoft 365 configuration controls. This checklist focuses on the types of evidence documents and records auditors expect to see during an ISO 27001 audit — it is framework and platform-agnostic.
Before every audit or surveillance visit. Some items — like access reviews and review dates — should be checked at least quarterly.
Yes. Certvik automates evidence collection from your Microsoft 365 environment, assigns review dates, routes evidence through approval workflows, and maintains a full audit trail — so your evidence pack stays current year-round.
Related resources