Tasks and evidence
Tasks and evidence for ISO 42001 and ISO 27001
Who does what, and has it been done? From a recurring access review to an AI impact assessment: assign the work to the right control and owner, record what the evidence must show and let AI pre-check it before a colleague reviews it.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Task
- Linked to a controlWith the expected result
- Ownership
- Assignee and reviewerWith a deadline and recurrence
- Evidence
- Requirements up frontWhat it must demonstrate
- Review
- AI pre-check, then a personThe reviewer decides
01 / Tasks and ownership
Who does what,
and has it been done?
Basenorm links every task to a control and an owner. You see what is open, who is working on it and what has been completed.
- 01Define the work
Describe the task, the related control and the expected result. Add requirements for the evidence.
- 02Assign an assignee and reviewer
Make clear who submits and who reviews. Set a deadline and recurrence where needed.
- 03Let people and integrations contribute
Employees carry out tasks. Connected systems and agents can also contribute through the API and MCP.
- 04Record results and follow-up
Attach evidence, review the result and record what still needs to happen.
02 / Interactive example
From task
to reviewed evidence
Try the flow for an access review: set the requirements, complete the task, ask AI for help, let AI pre-check the evidence and send it for peer review.
Example / access rights
Make expectations clear
Record what the evidence needs to demonstrate. Your colleague and the AI pre-check use the same requirements.
- 01Systems and accounts
Which systems and accounts were reviewed?
- 02Review and findings
How was the review performed and what exceptions were found?
- 03Follow-up
What was done about the exceptions?
03 / Evidence and review
Good evidence starts
with a clear request
Define what the evidence needs to demonstrate. AI helps your colleague get started and checks what may be missing. A second person reviews the result.
- BeforeRequirements first
The recorded requirements give the person doing the task and the AI check the same context.
- DuringHelp when you need it
An employee can ask AI for guidance and then submit the evidence.
- AfterA substantive review
An AI check is an initial assessment. The reviewer evaluates the evidence and decides what happens next.
04 / Questions
Questions about
tasks and evidence
How do tasks relate to controls?
Every task is linked to a control, with an owner, a reviewer, a deadline and, where needed, a recurrence. The evidence is linked to the control and counts wherever that control counts.
What does the AI pre-check do?
It compares the submitted evidence with the requirements you recorded for the task and highlights what may be missing. It is an initial check: a colleague reviews the content and decides.
Can integrations and agents complete tasks?
Yes, within the permissions you grant. Connected systems and agents can deliver results through the API and MCP. The configured review still applies.
Who decides whether evidence is sufficient?
Your reviewer decides within your organisation. In a certification audit, the auditor assesses whether controls and evidence meet the standard.
Book a demo
See how your team works on tasks and evidence
Together we look at your controls, owners and the evidence you collect today.
- How tasks link to your controls and owners.
- How the AI pre-check compares evidence with your requirements.
- How review and follow-up are recorded.
Hosted in the Netherlands. Your data stays in the EU.