An ISO 27001 auditor does not certify your policies. They sample evidence that the policies operate: a ticket, a log, a signed review, a restore test. Most failed audits are not failures of security. They are failures to produce the evidence of something that was in fact being done.
This map lists, for the clauses and controls auditors sample most often, the kind of evidence that usually satisfies them. It follows ISO/IEC 27001:2022. The transition period for the 2013 edition ended in October 2025, so certificates now issue against 2022.
It is a starting list, not a substitute for the standard. Your scope and your Statement of Applicability decide what applies to you. Obtain the standard itself from ISO or BIS.
The management system, clauses 4 to 10
Clauses 4 to 10 are mandatory for everyone. There is no exclusion.
| Clause | What the auditor wants to see |
|---|---|
| 4.1 – 4.3 Context and scope | A record of internal and external issues, the interested parties and their requirements, and a written scope statement that says what is in and what is out. |
| 5.2 – 5.3 Leadership | An information security policy approved by top management. Named roles and responsibilities. Minutes that show management is actually involved. |
| 6.1.2 Risk assessment | A defined method with criteria for likelihood and impact, and a risk register with owners and dates. |
| 6.1.3 Risk treatment | A treatment plan and the Statement of Applicability, which lists every Annex A control with the reason it is included or excluded and its implementation status. Management approval of residual risk. |
| 6.2 Objectives | Security objectives that are measurable, with a record of how they are tracked. |
| 7.2 – 7.3 Competence and awareness | Training and awareness records, and evidence that people in security roles are competent for them. |
| 7.5 Documented information | Version control, approval and distribution of the ISMS documents. |
| 8.1 – 8.3 Operation | Evidence that risk assessments are repeated at planned intervals and that the treatment plan is being carried out. |
| 9.1 Monitoring and measurement | What you measure, how often, who reviews it, and the results. |
| 9.2 Internal audit | An audit programme, audit reports, findings and evidence that the auditors are independent of what they audit. |
| 9.3 Management review | Minutes of a review that covers the required inputs, with decisions and actions recorded. |
| 10.1 – 10.2 Improvement | A nonconformity register with root cause, corrective action and a check that the action worked. |
Annex A, 93 controls in four themes
Annex A of the 2022 edition has 93 controls in four themes: Organizational (37), People (8), Physical (14) and Technological (34). You decide which apply, and the Statement of Applicability records why. The table lists the controls auditors sample most often.
| Control | Evidence typically sampled |
|---|---|
| 5.9 Inventory of information and other associated assets | An asset register with owners and classification, and evidence it is reviewed. |
| 5.15 Access control, 5.18 Access rights | The access control policy. Joiner, mover and leaver tickets. Signed periodic access reviews. |
| 5.19 – 5.22 Supplier relationships | A supplier register, security clauses in contracts, and assessments or reviews of key suppliers. |
| 5.23 Use of cloud services | A cloud inventory, a mapping of who is responsible for what, and exit arrangements. |
| 5.24 – 5.28 Incident management | The incident procedure, an incident log, post-incident reviews, and records of how evidence was handled. |
| 5.30 ICT readiness for business continuity | A business impact analysis, recovery objectives and the results of a recovery test. |
| 5.31 Legal and contractual requirements, 5.34 Privacy and protection of PII | A register of the laws and contracts that apply, and how personal data obligations are met. |
| 6.1 Screening, 6.3 Awareness and training | Screening records and training completion, including for new joiners. |
| 7.2 Physical entry, 7.4 Physical security monitoring, 7.14 Secure disposal or re-use of equipment | Visitor logs, entry controls, camera retention, and certificates or records of disposal. |
| 8.2 Privileged access rights | A list of privileged accounts, who approved each, and the last review. |
| 8.5 Secure authentication | A configuration export or screenshots showing multi-factor authentication enforced. |
| 8.7 Protection against malware | Endpoint protection coverage reports and update status. |
| 8.8 Management of technical vulnerabilities | Scan reports, a remediation timeline by severity, and approved exceptions. |
| 8.9 Configuration management | Baselines and evidence of how drift is detected. |
| 8.13 Information backup | The backup schedule and, above all, restore test records. |
| 8.15 Logging, 8.16 Monitoring activities | A list of log sources, retention settings, example alerts and the response that followed. |
| 8.20 Networks security, 8.22 Segregation of networks | Network diagrams and firewall rule review records. |
| 8.24 Use of cryptography | A cryptography policy, key management arrangements and the TLS configuration of public services. |
| 8.28 Secure coding, 8.29 Security testing, 8.32 Change management | Secure development guidance, test reports, and change tickets with approvals. |
Habits that make audits easy
- Collect evidence as the work happens, not in the two weeks before the audit. A restore test run in March is worth more than a screenshot taken in September.
- Date everything and name who did it. Undated evidence is weak evidence.
- Keep a single evidence index that points each control to where its evidence lives and who owns it.
- Write the Statement of Applicability honestly. An excluded control with a sound reason is fine. An included control with no evidence is a nonconformity.
- Run the internal audit for real. Auditors can tell when it was done the week before.