Evidence: questions and answers.
What counts as evidence, how long to keep it and how to use it for several frameworks.
What counts as evidence for a control?
Evidence is anything that shows a control is designed and works: policies, procedures, configuration exports, logs, review records, training records, meeting minutes and test results. Auditors look for evidence that matches the control description and covers the period they review.
How long should we keep evidence?
ISO 27001 does not prescribe one retention period, so you set your own in line with legal and contractual requirements. Many organisations keep evidence for at least one three-year certification cycle. Evidence that contains personal data falls under the GDPR and should not be kept longer than necessary.
What is evidence freshness?
Evidence shows that a control worked at a certain moment, so it ages. You set a review frequency per control, for example quarterly access reviews or an annual supplier assessment, and renew the evidence on that schedule. Evidence that is out of date is a common audit finding.
How do you organise evidence for several frameworks?
Attach evidence to the control, not to a framework. When the control counts for ISO 27001, NIS2 and ISO 42001, the same evidence is available for each of them. You only add evidence where a framework asks for something specific.
What is the difference between automated and manual evidence?
Automated evidence comes directly from systems, such as configuration exports or logs. Manual evidence is produced by people, such as approvals, management review minutes and training records. Management system standards always need both, because many requirements are about decisions people take.
Book a demo
Your question not answered?
In a demo we answer your questions in the context of your own frameworks and scope.
- Where you stand with ISO 27001 and ISO 42001.
- Which frameworks apply to you.
- How Basenorm keeps your management system current.
Hosted in the Netherlands. Your data stays in the EU.