What Evidence Do You Need for ISO 27001 Certification?

When business owners start preparing for ISO 27001 Certification Services, one of the most common concerns we hear is: what evidence will the auditor actually want to see?

ISO 27001 is not about producing paperwork for the sake of it. Auditors are looking for clear, practical evidence that information security is managed effectively and embedded into the way your business operates.

From our experience at JR Consultants, organisations that understand the evidence requirements early on are far more confident and better prepared when it comes to their certification audit. Below, we explain the key types of evidence you will need and share five practical tips to help you get it right.

What counts as evidence for ISO 27001?

In simple terms, evidence is anything that demonstrates your Information Security Management System (ISMS) is in place, working, and aligned with ISO 27001 requirements.

This can include:

• Documented policies and procedures
• Records and logs showing activities have taken place
• Screenshots or system outputs
• Training records
• Meeting minutes and review notes

Auditors will usually sample evidence rather than review everything, so quality and relevance matter more than volume.

Tip 1: Make sure your documentation reflects reality

One of the most common issues we see is documentation that looks good on paper but does not match what actually happens day to day.

Your information security policies, procedures, and risk assessments should reflect how your business truly operates. If your access control process says one thing but staff do another, that gap will quickly become apparent during an audit.

Keep documentation clear, realistic, and aligned with existing workflows. Auditors are not looking for perfection, but they do expect consistency.

Tip 2: Keep evidence organised and easy to access

During an ISO 27001 audit, time is limited. Struggling to locate evidence can create unnecessary stress and give the impression that processes are not well-controlled.

We always recommend:

• Storing ISMS documentation in a central location
• Using clear file names and version control
• Keeping records logically organised by control or process

Being able to quickly produce evidence when asked shows confidence and maturity in your information security management.

Tip 3: Demonstrate risk-based decision making

ISO 27001 is built around risk management, so auditors will want to see evidence that decisions are made based on risk.

Key evidence here includes:

• A documented risk assessment methodology
• A current risk register
• A risk treatment plan
• A completed Statement of Applicability with clear justifications

Auditors often ask why certain controls were chosen or excluded. Having clear, risk-based reasoning documented makes these conversations straightforward.

Tip 4: Show that processes are being followed over time

ISO 27001 requires evidence that your ISMS is operating, not just that it exists.

This means showing records over a period of time, such as:

• Access reviews
• Incident logs, even if no major incidents occurred
• Backup checks
• Supplier reviews
• Change management records

A common mistake is waiting until just before the audit to generate evidence. In reality, auditors want to see that processes have been followed consistently, not created at the last minute.

Tip 5: Don’t forget people and leadership evidence

Information security is not just technical. Auditors will also look for evidence that staff and leadership are engaged.

This may include:

• Training and awareness records
• Staff acknowledgements of policies
• Internal audit reports
• Management review meeting minutes
• Corrective actions and improvements

Evidence of management involvement is particularly important. It shows that ISO 27001 is supported at the top of the business, not treated as an IT-only exercise.

Quality over quantity

One final point we always stress is that more evidence is not always better. Overloading auditors with unnecessary documents can be just as unhelpful as having too little.

Focus on clear, relevant evidence that demonstrates control, consistency, and continual improvement.