ISO/IEC 27001 FAQ Certification Body Evidence

Start with evidence that ISO/IEC 27001 itself requires the organization to retain or make available: the ISMS scope, risk-assessment and treatment process and results, information security objectives, operational records needed for confidence, monitoring and measurement results, internal-audit programme and results, management-review results, and nonconformity and corrective-action records.

Then add operating evidence for the necessary controls identified in the Statement of Applicability. The audit is based on sampling, so an evidence index improves retrieval but does not replace underlying records or guarantee certification.

Design evidence explains how the ISMS is meant to work: policy, scope, roles, criteria, procedures, SoA rationales, treatment plans, and control designs. Operating evidence shows that those arrangements actually ran during the relevant period and that results were evaluated.

A policy can support a design claim but does not prove that an access review occurred, a recovery test succeeded, a supplier was reviewed, or a corrective action was effective. Match the evidence to the claim and audited period. Protect secrets and personal data by agreeing secure access, live demonstration, or proportionate redaction with the certification body rather than withholding evidence without explanation. The auditor still needs enough verifiable information to reach a conclusion.

The organization owns its ISMS and evidence. Process owners, control owners, risk owners, internal auditors, and top management each retain their ISO/IEC 27001 responsibilities; an external auditor should not be written into those operating roles.

The certification body audits the ISMS and makes the certification decision under the applicable scheme. ISO/IEC 27006-1:2024 adds ISMS-specific requirements for bodies that audit and certify against ISO/IEC 27001 and complements ISO/IEC 17021-1. Accreditation is a separate assessment of the certification body's competence for the relevant activity and scope.

Update evidence through normal ISMS operation, not only before an external audit. Planned monitoring, risk reassessment, internal audit, management review, and corrective action continuously create or change the records on which certification relies.

Significant changes to scope, products, services, locations, suppliers, technology, risks, controls, or legal and contractual requirements should trigger review of the linked risk treatment, SoA, operating evidence, and certification-body notification obligations. The exact external notification and audit process comes from the certification arrangement, not from this checklist.