Stage 2 Audit Evidence Index Template (ISO/IEC 27001)

Stage 2 audit workbook: evidence index per clause and Annex A theme, sampling populations, interview schedule, evidence rules, debrief log, closing notes

ISMS und ISO/IEC 27001VollständigISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and Annex A (cited only); ISO/IEC 17021-1:2015; ISO/IEC 27006-1:2024stage audit evidence indexAktualisiert 01.11.2026

Im Editor öffnen.md herunterladen

Anleitung: Use it between Stage 1 and Stage 2 and live during the audit week. Fill the clause index and the sampling populations first. The main pitfall is pointing to policies instead of dated records that show the ISMS operates.

Vorschau

Stage 2 Audit Evidence Index: [Organization name]

Evidence index and audit-week workbook for the Stage 2 certification audit of the information security management system (ISMS) of [Organization name] against ISO/IEC 27001:2022 + Amd 1:2024. It lists where the evidence for each clause (4 to 10) and each Annex A theme sits, prepares the populations auditors sample from, sets the interview schedule and the rules for the audit room and for remote evidence, and keeps the daily debrief log and the closing meeting notes. Stage 2 is run by the certification body (CB) under ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-092
Version	[1.0]
Status	[Draft / In review / In use during audit / Final]
Owner	[@isms-manager]
Approvers/reviewers	[@ciso], [@ceo]
Last updated	YYYY-MM-DD
Classification	[Confidential]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024; CB rules ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024
Certification body and audit team	[CB name], lead auditor [name], auditors [names], technical expert [name or none]
Audit dates and mode	[YYYY-MM-DD to YYYY-MM-DD, on site / remote / mixed]
SoA version audited	DOC-ISMS-011, version [n]
Evidence period	[YYYY-MM-DD to YYYY-MM-DD]
Next scheduled review	[Before first surveillance audit, YYYY-MM-DD]

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Index complete]	YYYY-MM-DD
Top management	[@ceo]	[Ready for Stage 2]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
0.1 (Example)	2027-04-19	[@isms-manager]	Clause and Annex A index built from DOC-ISMS-033
1.0 (Example)	2027-05-07	[@isms-manager]	Populations refreshed to 2027-05-07, interview schedule confirmed
1.1 (Example)	2027-05-12	[@isms-manager]	Debrief log and closing meeting notes added

Purpose and how to use
Audit team, roles and evidence flow
Audit room and remote evidence rules
Evidence index by clause
Evidence index by Annex A theme
Sampling readiness
Interview schedule
Daily debrief log
Findings raised during the audit
Closing meeting notes
Size tiers
Records and evidence
References

1. Purpose and how to use

Stage 2 evaluates the implementation and effectiveness of the ISMS: that the processes in clauses 4 to 10 run as documented, that the applicable controls in the Statement of Applicability operate, and that the ISMS achieves its objectives. The audit team follows its own audit plan and samples records; this index lets the audit guide find any piece of evidence within minutes and shows the team exactly what was shown.

How to use it:

Build sections 4 and 5 from DOC-ISMS-033 (control evidence matrix) and check each link opens the current record.
Refresh section 6 populations to a cut-off date shortly before Stage 2.
Confirm section 7 with every interviewee and a deputy.
During the audit, log each request and what was shown (section 2 flow), and fill section 8 at the end of each day.
After the closing meeting, move findings to isms/certification-findings-action-plan and keep this file as the audit record.

2. Audit team, roles and evidence flow

Role	Name	Responsibility
Audit guide	[@isms-manager]	Accompanies the audit team, introduces interviewees, keeps time
Evidence runner	[@name]	Retrieves records from systems and the document store
Scribe	[@name]	Logs each request, the evidence shown and any open request in the request log
Process owners	[@owners]	Answer questions on their process and show records
Top management representative	[@ceo]	Leadership interview, opening and closing meetings

Request log format:

Req ID	Time	Auditor	Request	Clause or control	Evidence shown	Shown by	Open follow-up
REQ-001 (Example)	2027-05-10 10:40	Lead auditor	Last access review of production cloud accounts	A.5.18, A.8.2	Q2 access review record, 3 removals with tickets	[@head-of-engineering-ops]	None
REQ-002 (Example)	2027-05-10 11:15	Lead auditor	Training record for two persons flagged at Stage 1	7.3	Completion records dated 2027-05-03	[@hr-lead]	None
[REQ-NNN]	[time]	[auditor]	[request]	[ref]	[record]	[@name]	[follow-up]

3. Audit room and remote evidence rules

On-site audit room

Room booked for all audit days, with a screen, power and guest network only; no access to internal networks for auditor devices.
Visitors signed in, badged and escorted outside the audit room (DOC-ISMS-055 physical security policy).
A clean desk in the room: only the evidence being discussed is on the table or the screen (DOC-ISMS-056).
Printed evidence is collected and shredded at the end of each day, unless the auditor needs a copy under the CB's confidentiality terms.

Remote evidence

Show evidence by screen share from the live system or the document store by default.
Files are shared only when the auditor needs a copy for the audit file, through the channel agreed in the CB contract, under DOC-ISMS-043 (information transfer policy).
Personal data, secrets, full vulnerability details and customer data are shown, not sent; redact where a copy is unavoidable.
No recording of sessions unless both parties agree in writing.
Confirm the identity of every participant at the start of each call.

Evidence class	Show on screen	Provide a copy	Condition
Policies and procedures	Yes	Yes	Read-only export with version
Records with no personal data (for example change tickets)	Yes	On request	Through agreed channel
Records with personal data (for example HR screening)	Yes	No	Show a sample, no copies
Security configuration and vulnerability data	Yes	No	Show live or redacted
Customer contracts	Extracts only	No	Commercial terms hidden

4. Evidence index by clause

Clause	What the auditor typically checks	Evidence (record, ID, location)	Owner	Status
4.1	Internal and external issues identified, including the climate change decision (Amd 1:2024)	DOC-ISMS-003, steering minute approving it	[@isms-manager]	[Ready / Gap]
4.2	Interested parties and their relevant requirements, including any climate-related ones	DOC-ISMS-003, DOC-ISMS-014	[@isms-manager]	[Ready / Gap]
4.3	Scope boundaries, interfaces and dependencies match reality	DOC-ISMS-002, network and cloud diagrams	[@isms-manager]	[Ready / Gap]
4.4	ISMS processes and their interactions established	DOC-ISMS-004 process map	[@isms-manager]	[Ready / Gap]
5.1	Top management leadership shown in practice	Steering committee minutes (DOC-ISMS-007), budget approval, interview	[@ceo]	[Ready / Gap]
5.2	Policy approved, communicated and available	DOC-ISMS-001, communication record, intranet page	[@ceo]	[Ready / Gap]
5.3	Roles and authorities assigned and communicated	DOC-ISMS-006, appointment records	[@ceo]	[Ready / Gap]
6.1.1	Risks and opportunities for the ISMS considered	DOC-ISMS-017	[@isms-manager]	[Ready / Gap]
6.1.2	Risk assessment performed with defined criteria, repeatable results	DOC-ISMS-010, DOC-ISMS-015, DOC-ISMS-016	[@isms-manager]	[Ready / Gap]
6.1.3	Treatment selected, SoA justified, plan approved, residual risk accepted by risk owners	DOC-ISMS-011, DOC-ISMS-013, DOC-ISMS-019	Risk owners	[Ready / Gap]
6.2	Objectives measurable, planned, monitored	DOC-ISMS-024, measurement results	[@ciso]	[Ready / Gap]
6.3	Changes to the ISMS planned	DOC-ISMS-025 change plan, change records	[@isms-manager]	[Ready / Gap]
7.1	Resources provided	DOC-ISMS-031 budget and resource plan	[@cfo]	[Ready / Gap]
7.2	Competence determined and evidenced	DOC-ISMS-026, certificates, training records	[@hr-lead]	[Ready / Gap]
7.3	Awareness of policy, contribution and consequences	Awareness completion records, interviews with staff	[@hr-lead]	[Ready / Gap]
7.4	Communication planned and done	DOC-ISMS-027, communication log	[@isms-manager]	[Ready / Gap]
7.5	Documented information controlled	DOC-ISMS-028, version history samples	[@isms-manager]	[Ready / Gap]
8.1	Processes planned and controlled, outsourced processes controlled	DOC-ISMS-032 calendar, operating procedures, supplier reviews	[@isms-manager]	[Ready / Gap]
8.2	Risk assessments at planned intervals and on change	Dated risk assessment results	[@isms-manager]	[Ready / Gap]
8.3	Risk treatment plan implemented	DOC-ISMS-013 status with completed actions	Risk owners	[Ready / Gap]
9.1	Monitoring and measurement results analysed	DOC-ISMS-080, DOC-ISMS-081	[@isms-manager]	[Ready / Gap]
9.2	Internal audit programme run by objective, competent auditors	DOC-ISMS-082, DOC-ISMS-084, auditor competence	[@internal-auditor]	[Ready / Gap]
9.3	Management review covers all inputs and records decisions	DOC-ISMS-085	[@ceo]	[Ready / Gap]
10.1	Continual improvement shown	DOC-ISMS-088 continual improvement register	[@isms-manager]	[Ready / Gap]
10.2	Nonconformities handled, root cause, effectiveness checked	DOC-ISMS-087, DOC-ISMS-086	[@isms-manager]	[Ready / Gap]

5. Evidence index by Annex A theme

5.1 A.5 Organizational controls (37)

Controls	Topic	Evidence (record, ID, location)	Owner	Status
A.5.1 to A.5.4	Policies, roles, segregation of duties, management responsibility	DOC-ISMS-005 policy index with review dates, DOC-ISMS-006	[@ciso]	[Ready / Gap]
A.5.5, A.5.6	Contacts with authorities and special interest groups	DOC-ISMS-069	[@ciso]	[Ready / Gap]
A.5.7	Threat intelligence (new in 2022)	DOC-ISMS-045, monthly triage log	[@security-lead]	[Ready / Gap]
A.5.8	Security in projects	DOC-ISMS-046 completed checklists for sampled projects	[@pmo-lead]	[Ready / Gap]
A.5.9 to A.5.14	Assets, acceptable use, return, classification, labelling, transfer	DOC-ISMS-012, DOC-ISMS-040, DOC-ISMS-042, DOC-ISMS-043, leaver asset returns	[@it-lead]	[Ready / Gap]
A.5.15 to A.5.18	Access rules, identities, authentication, access rights	DOC-ISMS-041, joiner and leaver tickets, quarterly access reviews	[@it-lead]	[Ready / Gap]
A.5.19 to A.5.23	Suppliers, agreements, ICT supply chain, monitoring, cloud services (A.5.23 new in 2022)	DOC-ISMS-066, DOC-ISMS-067 assessments, DOC-ISMS-068, DOC-ISMS-044	[@procurement-lead]	[Ready / Gap]
A.5.24 to A.5.28	Incident management and evidence	DOC-ISMS-020, DOC-ISMS-021 entries, DOC-ISMS-022 reviews	[@security-lead]	[Ready / Gap]
A.5.29, A.5.30	Security during disruption, ICT readiness (A.5.30 new in 2022)	DOC-ISMS-121, DOC-ISMS-047, DR test report	[@head-of-engineering-ops]	[Ready / Gap]
A.5.31 to A.5.34	Legal requirements, intellectual property, records, privacy	DOC-ISMS-014, licence inventory, retention schedule, records of processing	[@legal-lead], [@dpo]	[Ready / Gap]
A.5.35 to A.5.37	Independent review, compliance checks, operating procedures	DOC-ISMS-048, compliance check records, DOC-ISMS-049	[@isms-manager]	[Ready / Gap]

5.2 A.6 People controls (8)

Controls	Topic	Evidence	Owner	Status
A.6.1, A.6.2	Screening and employment terms	DOC-ISMS-050, sample of screening records (shown, not copied), contract template	[@hr-lead]	[Ready / Gap]
A.6.3	Awareness and training	Training completion report for the evidence period	[@hr-lead]	[Ready / Gap]
A.6.4, A.6.5	Disciplinary process, duties after leaving	DOC-ISMS-052, DOC-ISMS-053 completed checklists	[@hr-lead]	[Ready / Gap]
A.6.6	Confidentiality agreements	DOC-ISMS-051 signed samples	[@legal-lead]	[Ready / Gap]
A.6.7	Remote working	DOC-ISMS-054, device compliance report	[@it-lead]	[Ready / Gap]
A.6.8	Event reporting	DOC-ISMS-023, reports received in the incident register	[@security-lead]	[Ready / Gap]

5.3 A.7 Physical controls (14)

Controls	Topic	Evidence	Owner	Status
A.7.1 to A.7.6	Perimeters, entry, secure areas, monitoring (A.7.4 new in 2022), environmental threats	DOC-ISMS-055, badge access logs, visitor log, colocation provider assurance (DOC-ISMS-079)	[@facilities-lead]	[Ready / Gap]
A.7.7	Clear desk and clear screen	DOC-ISMS-056, walk-round check records	[@facilities-lead]	[Ready / Gap]
A.7.8 to A.7.13	Equipment, off-site assets, media, utilities, cabling, maintenance	Asset records, maintenance logs, cloud provider assurance for hosted equipment	[@it-lead]	[Ready / Gap]
A.7.14	Disposal and reuse	DOC-ISMS-057 disposal records and certificates	[@it-lead]	[Ready / Gap]

5.4 A.8 Technological controls (34)

Controls	Topic	Evidence	Owner	Status
A.8.1	Endpoint devices	DOC-ISMS-058, MDM compliance report	[@it-lead]	[Ready / Gap]
A.8.2 to A.8.5	Privileged access, access restriction, source code access, authentication	Privileged account list and review, MFA coverage report, repository permissions	[@head-of-engineering-ops]	[Ready / Gap]
A.8.6	Capacity	Capacity reviews, monitoring dashboards	[@head-of-engineering-ops]	[Ready / Gap]
A.8.7, A.8.8	Malware, vulnerabilities	DOC-ISMS-059, EDR coverage report, DOC-ISMS-072 remediation tracker with SLA results	[@security-lead]	[Ready / Gap]
A.8.9 to A.8.12	Configuration, deletion, masking, leakage prevention (all new in 2022)	DOC-ISMS-060 baseline with drift report, deletion records, DOC-ISMS-062	[@security-lead]	[Ready / Gap]
A.8.13, A.8.14	Backup, redundancy	DOC-ISMS-061, DOC-ISMS-071 restore test log, region failover test	[@head-of-engineering-ops]	[Ready / Gap]
A.8.15 to A.8.17	Logging, monitoring (A.8.16 new in 2022), clock synchronisation	Logging standard, DOC-ISMS-064 alert triage records, time source configuration	[@security-lead]	[Ready / Gap]
A.8.18, A.8.19	Privileged utilities, software installation	Allow-list configuration, change records	[@it-lead]	[Ready / Gap]
A.8.20 to A.8.23	Network security, network services, segregation, web filtering (A.8.23 new in 2022)	DOC-ISMS-063, firewall rule review, filtering policy report	[@head-of-engineering-ops]	[Ready / Gap]
A.8.24	Cryptography	Cryptography standard, DOC-ISMS-070 key register	[@security-lead]	[Ready / Gap]
A.8.25 to A.8.31	Secure development, requirements, architecture, secure coding (A.8.28 new in 2022), testing, outsourced development, environment separation	DOC-ISMS-065, pull request reviews, SAST and dependency scan results, DOC-ISMS-077	[@engineering-lead]	[Ready / Gap]
A.8.32	Change management	Sample of change tickets with approvals	[@head-of-engineering-ops]	[Ready / Gap]
A.8.33, A.8.34	Test information, protection during audit testing	Test data rules, approval for any audit testing on production	[@engineering-lead]	[Ready / Gap]

6. Sampling readiness

Example populations (Example: Quillmere Analytics Ltd, evidence period 2027-01-04 to 2027-05-07; leavers over the 12 months to 2027-05-07):

Pop ID	Population	Source system	Fields in the list	Count (Example)	Ready
POP-01	Joiners (employees and contractors)	HR system, supplier register	Name, start date, role, screening date, NDA date, training date	9	[Yes / No]
POP-02	Leavers (12 months)	HR system	Name, end date, account disable date per system, asset return date	11	[Yes / No]
POP-03	Role changes	HR system	Name, date, old role, new role, access change ticket	3	[Yes / No]
POP-04	Production changes	Change and deployment tool	ID, date, approver, test evidence, rollback plan	186	[Yes / No]
POP-05	Security events and incidents	DOC-ISMS-021	ID, date, severity, status, closure date	13	[Yes / No]
POP-06	Vulnerabilities rated high or critical	DOC-ISMS-072	ID, discovered, fixed, SLA met	27	[Yes / No]
POP-07	Privileged accounts	Identity provider, cloud console	Account, owner, last review	14	[Yes / No]
POP-08	Critical suppliers	DOC-ISMS-066	Supplier, service, last assessment, contract clauses	9	[Yes / No]
POP-09	Backup restore tests	DOC-ISMS-071	Date, system, result, time to restore	6	[Yes / No]
POP-10	Endpoint devices	MDM	Device, owner, encryption, OS version, compliance state	52	[Yes / No]

Consistency checks before the audit:

POP-01 joiners plus existing staff minus POP-02 leavers equals the current scope headcount (46 persons: 38 employees, 8 contractors).
Every POP-05 incident has a matching entry in DOC-ISMS-022 where a post-incident review was required.
Every POP-06 item has a fix date or an approved exception (security/security-exception-request).

7. Interview schedule

Example schedule (Example: Quillmere Analytics Ltd, Stage 2 of 3.5 audit days over three calendar days, 2027-05-10 to 2027-05-12; a second auditor joins for half a day on day 2):

Day and time	Session	Interviewee	Deputy	Clauses and controls
Day 1, 09:00	Opening meeting	[@ceo], [@isms-manager]	[@ciso]	Audit plan, scope confirmation
Day 1, 09:45	Leadership, context, policy	[@ceo]	[@coo]	4.1 to 5.3
Day 1, 11:00	Risk assessment and treatment	[@isms-manager]	[@coo]	6.1, 8.2, 8.3, SoA
Day 1, 14:00	Objectives, measurement, resources	[@isms-manager]	[@cfo]	6.2, 7.1, 9.1
Day 2, 09:00	People controls and HR	[@hr-lead]	[@coo]	7.2, 7.3, A.6
Day 2, 11:00	Access, identities, endpoints	[@it-lead]	[@head-of-engineering-ops]	A.5.15 to A.5.18, A.8.1 to A.8.5
Day 2, 14:00	Cloud operations, backup, logging	[@head-of-engineering-ops]	[@engineering-lead]	A.5.23, A.8.13 to A.8.17
Day 2, 14:00 (second auditor)	Secure development and change	[@engineering-lead]	[@head-of-engineering-ops]	A.8.25 to A.8.32
Day 2, 16:00	Office walk-round	[@facilities-lead]	[@isms-manager]	A.7
Day 3, 09:00	Suppliers and legal	[@procurement-lead], [@legal-lead]	[@coo]	A.5.19 to A.5.22, A.5.31 to A.5.34
Day 3, 10:15	Incidents, continuity, threat intelligence	[@security-lead]	[@isms-manager]	A.5.7, A.5.24 to A.5.30
Day 3, 11:30	Internal audit, management review, improvement	[@internal-auditor], [@ceo]	[@isms-manager]	9.2, 9.3, 10
Day 3, 13:30	Auditor preparation time	None	None	CB internal review
Day 3, 15:00	Closing meeting	[@ceo], [@isms-manager], process owners	[@ciso]	Findings, recommendation, next steps

8. Daily debrief log

Day	Date	Areas covered	Potential findings raised by auditor	Open requests	Our actions overnight	Owner
1 (Example)	2027-05-10	4 to 6, 7.1, 9.1	One objective has no result for April; no record of risk owner approval of the treatment plan DOC-ISMS-013 or of acceptance for the High residual risks	REQ-007: risk acceptance for R-018	Retrieve signed acceptance ACC-001 from DOC-ISMS-019, add April result with explanation, collect any approval records	[@isms-manager]
2 (Example)	2027-05-11	7.2, 7.3, A.6, A.5.15 to A.5.18, A.8.1 to A.8.5, A.5.23, A.8.13 to A.8.17, A.8.25 to A.8.32, A.7	1 of 10 sampled leavers kept access to the support ticketing tool for 9 days (target 1 business day)	None	Prepare root cause and corrective action proposal	[@it-lead]
[n]	YYYY-MM-DD	[areas]	[findings]	[REQ-NNN]	[actions]	[@owner]

9. Findings raised during the audit

ID	CB ref	Grade (CB)	Requirement	Finding summary	Objective evidence	Next step
S2F-001 (Example)	NC-01	Major nonconformity	6.1.3	No record that risk owners approved the risk treatment plan or accepted residual risks; 14 High risks without acceptance (CBF-2027-01 in DOC-ISMS-093)	DOC-ISMS-013 v0.9 unsigned, DOC-ISMS-016 export	Correction, root cause and corrective action, with implementation verified by the CB before the decision, Example: evidence within 90 days as set by the CB
S2F-002 (Example)	NC-02	Minor nonconformity	A.5.18	1 of 10 sampled leavers kept access to the support ticketing tool for 9 days after the leaving date (CBF-2027-02 in DOC-ISMS-093)	POP-02 sample, ticketing tool audit log	Correction and corrective action plan in `isms/certification-findings-action-plan`, Example: submitted to CB within the period the CB sets (for example 30 days)
S2F-003 to S2F-008 (Example)	NC-03, NC-04, OFI-01 to OFI-04	2 minor nonconformities, 4 opportunities for improvement	A.5.19, 7.2, 9.1, A.8.16, A.5.7, 7.4	See CBF-2027-03 to CBF-2027-08 in DOC-ISMS-093 section 4	As recorded by the CB	Plans for the minors; decisions recorded for each OFI
[S2F-NNN]	[ref]	[grade]	[ref]	[summary]	[evidence]	[step]

10. Closing meeting notes

Field	Value
Date and time	[YYYY-MM-DD hh:mm]
Attendees	[names and roles]
Scope confirmed	[Yes / No, with changes]
Sampling statement by CB	[The audit was based on samples; findings may exist that were not found]
Findings presented	Example: 1 major, 3 minor, 4 opportunities for improvement
Deadlines stated by CB	Example: correction and corrective action plan for all nonconformities within 30 days (2027-06-11) and evidence for the major NC-01 within 90 days (2027-08-10), as set by the CB
Audit team recommendation	[Recommended for certification subject to acceptance of corrective action plans / Not recommended / Follow-up visit needed]
Expected certification decision and certificate date	[as stated by the CB]
First surveillance audit	No later than 12 months from the certification decision date; Example: planned for [month]
Questions raised by us and answers	[notes]
Actions for us	Transfer findings to DOC-ISMS-093, brief top management, update DOC-ISMS-094 certification cycle plan

11. Size tiers

Aspect	Small: Quillmere Analytics Ltd (Example)	Medium: Quillmere Health Systems (Example)	Large: Quillmere Group (Example)
Profile	46 persons, one office plus remote staff, one cloud provider in two regions	320 staff, two offices, one colocation suite	2,400 staff, 6 sites in 4 countries, OT and IT, ISO 9001 and ISO 22301 certified
Audit team	One lead auditor	Lead auditor plus one auditor, possibly a health-sector technical expert	Several auditors in parallel tracks, site visits by sample under ISO/IEC 27006-1 and IAF MD 1:2023 (Global ACI-TECH-3-001)
Evidence coordination	ISMS manager (0.5 FTE) as guide, one runner	ISMS manager as guide, security team as runners, one scribe	Central evidence desk in the CISO office, site coordinators, shared request log across sites
Populations	About 10, small counts	About 15, including colocation access and clinical customer contracts	Per site and per function, including OT change and remote access populations
Audit room	Remote with office walk-round	One office as audit base, visit to the colocation suite	Audit room at each visited site, daily cross-site debrief
Integrated audit	None	ISO/IEC 27701:2025 extension planned for next year	Combined with ISO 9001 and ISO 22301 under IAF MD 11:2023 (Global ACI-TECH-3-008) if the CB agrees

12. Records and evidence

Record	Owner	Location	Retention
This evidence index, final version	[@isms-manager]	[ISMS document store, restricted]	Certification cycle + 3 years (Example)
Request log (section 2)	Scribe	[ISMS document store, restricted]	Certification cycle + 3 years
Copies given to the CB, with redaction notes	[@isms-manager]	[ISMS document store, restricted]	Certification cycle + 3 years
Daily debrief log and closing meeting notes	[@isms-manager]	[ISMS document store]	Certification cycle + 3 years
CB audit plan and audit report	[@isms-manager]	[ISMS document store]	Certification cycle + 3 years
Findings and corrective action records	[@isms-manager]	DOC-ISMS-093, DOC-ISMS-086, DOC-ISMS-087	Certification cycle + 3 years

Keep the permanent control-to-evidence links in isms/control-evidence-matrix (DOC-ISMS-033) and register these records in DOC-ISMS-028.

13. References

Reference	Edition	Use
ISO/IEC 27001:2022 (https://www.iso.org/standard/82875.html)	2022	Clauses 4 to 10 and Annex A
ISO/IEC 27001:2022/Amd 1:2024 (https://www.iso.org/standard/88435.html)	2024-02-23	Climate change in 4.1 and 4.2
ISO/IEC 27002:2022 (https://www.iso.org/standard/75652.html)	2022	Control guidance
ISO/IEC 17021-1:2015 (https://www.iso.org/standard/61651.html)	2015	Stage 2, findings, certification decision
ISO/IEC 27006-1:2024 (https://www.iso.org/standard/82908.html)	2024	ISMS audit requirements, multi-site
ISO/IEC 27007:2020 (https://www.iso.org/standard/77802.html)	2020, under revision	ISMS auditing guidance
ISO 19011:2026 (https://www.iso.org/standard/88984.html)	2026	Auditing management systems
IAF MD 1:2023 and IAF MD 4:2025, re-issued as Global ACI-TECH-3-001 and Global ACI-TECH-3-003	Issue 3 each; Global ACI v1.0 in force 28 Aug 2026 (check the current issue)	Multi-site sampling, remote audit techniques

Related templates: isms/stage-1-readiness-pack, isms/certification-findings-action-plan, isms/certification-cycle-plan, isms/control-evidence-matrix, isms/audit-findings-register, isms/surveillance-readiness-health-check, compliance/statement-of-applicability, compliance/capa-nonconformity, isms/certification-audit-explained.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10 and Annex A themes) and with the Stage 2 requirements for certification bodies in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The index, audit focus summaries, rules and examples are original; control labels are short descriptions written for this library, and no ISO/IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official text from ISO (https://www.iso.org/standard/82875.html) or your national standards body. Check the current editions and your certification body's audit plan and rules before use. Using this index does not guarantee certification; the certification decision belongs to the certification body. Template licence: MIT.