ISO 27001 evidence collection with ISMS Copilot
Build the evidence package for the certification audit — Annex A operating effectiveness plus clause 9 records.
Evidence package for the certification audit
An ISO 27001 certification auditor does not just read your policies — they sample records that show the ISMS actually operated. That splits into two streams. First, operating-effectiveness evidence for each Annex A control marked applicable in your Statement of Applicability: access reviews performed, supplier assessments completed, change records, log reviews. Second, the clause 9 management records the standard mandates: clause 9.1 monitoring and measurement results, clause 9.2 internal audit programme and reports, clause 9.3 management review minutes with the required inputs and outputs. ISMS Copilot walks your SoA control by control, names the record type each one needs, and builds the clause 9 evidence checklist so the certification body finds a complete trail rather than a documentation set with no proof of operation.
ISO 27001 framework details →Certification evidence workflow
Walk the Statement of Applicability and name the record type each applicable Annex A control needs
Build the clause 9.1 monitoring and measurement evidence list
Assemble the clause 9.2 internal audit programme, reports, and corrective actions
Draft clause 9.3 management review minutes against the required inputs and outputs
Identify operating-effectiveness gaps before the certification body samples them
Map evidence across frameworks for organizations also pursuing SOC 2 or NIS 2
Why teams use it for ISO 27001 evidence
- Close the gap between a written ISMS and proof it operated
- Arrive at Stage 2 with a complete clause 9 records package
- Catch missing operating-effectiveness evidence before the auditor does
- Reusable evidence map for surveillance and recertification audits
Frequently Asked Questions
How is this different from policy generation?
Policy generation produces the documents that say what you do. Evidence collection produces the records that prove you did it — access reviews actually run, internal audits actually completed, management reviews actually held. Certification bodies sample the second category, and that is what this use case targets.
What clause 9 records does an auditor expect?
Clause 9.1 monitoring and measurement results, the clause 9.2 internal audit programme with reports and corrective actions, and clause 9.3 management review minutes covering the standard's required inputs and outputs. ISMS Copilot builds a checklist for each and flags what is missing.
Does it cover surveillance audits too?
Yes. The evidence map ISMS Copilot builds for the initial certification is reusable. For surveillance and recertification, you refresh the records and focus sampling on areas that changed since the last cycle.
Build your certification evidence package
Assemble Annex A operating-effectiveness evidence and clause 9 records before Stage 2.