ISO 27001 evidence readiness
Turn policies into traceable operating evidence before the certification audit.
A policy states intent. Evidence shows operation.
ISO/IEC 27001 readiness is not measured by the number of templates in a folder. The ISMS must connect scope, risks, treatment, controls, objectives, review and improvement.
For every required process and selected control, identify the owner, frequency, input, output, approval and evidence location. This creates traceability and reveals controls that exist only in prose.
Build an evidence index
Create one row per clause activity or applicable control. Record the requirement, control, owner, evidence example, period, status, gap and next review. Link to controlled artefacts rather than emailing copies around.
Evidence may include meeting decisions, access reviews, risk approvals, vendor reviews, training completion, incident records, change tickets, monitoring results, test reports and corrective actions. The correct evidence depends on scope and control design.
Test quality, not just presence
Check that evidence covers the intended population and period, has an accountable reviewer, matches the documented frequency and records exceptions. A single perfect sample may not prove a monthly control operated all year.
Where evidence is missing, distinguish a documentation gap from a design gap or an operating gap. Each needs a different fix and a different amount of time.
Keep certification roles clear
A readiness adviser can identify gaps, improve evidence and prepare teams. The accredited certification body independently audits and decides certification.
Avoid guarantees. A good readiness review makes scope choices, limitations, owners and residual risks visible so leadership can decide before the external audit.
Weekly readiness rhythm
Review overdue evidence, new exceptions, risk-treatment actions, control changes and decisions every week during the final preparation period. Escalate blocked items early.
The best indicator is not percent of documents complete. It is the proportion of applicable controls with an owner, operating design, current evidence, reviewed exceptions and a credible next collection date.