Control Evidence Matrix Template (ISO/IEC 27001 Clauses and 93 Controls)

Control Evidence Matrix: [Organization name] ISMS

One register that shows, for every requirement of ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and every one of the 93 Annex A controls, who owns the evidence, which record proves the requirement or control operates, where that record is kept, how often it is produced, when it was last collected and its status. It is the working index behind the Statement of Applicability (DOC-ISMS-011), the Stage 2 audit evidence index (DOC-ISMS-092) and every surveillance audit. Control labels are short descriptions written for this library, not official titles. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and how the matrix works
2. Status values and frequency codes
3. Evidence locations
4. Clauses 4 to 10
5. Annex A organizational controls (A.5)
6. Annex A people controls (A.6)
7. Annex A physical controls (A.7)
8. Annex A technological controls (A.8)
9. Summary and health of the evidence
10. Using the matrix for Stage 2 and surveillance audits
11. Size tiers
12. Records and maintenance of the matrix
13. References

1. Purpose and how the matrix works

The matrix answers the question every auditor asks: "show me". For each requirement and control it records:

• Owner: the role accountable for producing the evidence (usually the control owner named in DOC-ISMS-006).
• Evidence: the record type that proves operation, not only design.
• Location: where the record is kept, using the codes in section 3.
• Frequency: how often a new record is produced (codes in section 2).
• Last collected: date of the most recent record.
• Status: whether the evidence is current (section 2).

2. Status values and frequency codes

3. Evidence locations

4. Clauses 4 to 10

5. Annex A organizational controls (A.5)

6. Annex A people controls (A.6)

7. Annex A physical controls (A.7)

8. Annex A technological controls (A.8)

9. Summary and health of the evidence

Worked summary for Quillmere Analytics Ltd (Example), eight weeks before Stage 2:

Reading the example: 79 of the 92 applicable controls (86%) have current evidence. The 3 overdue and 2 gap items are the priority list for the next four weeks; each gets an owner and a date in the risk treatment plan or the corrective action log.

Useful indicators for the measurement programme (DOC-ISMS-080): percentage of applicable controls with current evidence, number of overdue records older than one period, and number of gaps.

10. Using the matrix for Stage 2 and surveillance audits

10.1 Before Stage 2

1. Freeze a snapshot of the matrix about [4 to 6] weeks before the audit and record the snapshot date in Document control.
2. Make sure every applicable control has at least one record from the period the ISMS has operated, and every clause 4 to 10 row has its record. Certification bodies usually expect one full internal audit of the ISMS and one management review before Stage 2 (CB practice, not a clause).
3. Close or plan every Gap. A Gap on a control marked "Implemented" in the SoA is a contradiction an auditor will find.
4. Build the Stage 2 audit evidence index (isms/stage-2-audit-evidence-index, DOC-ISMS-092) from the matrix: same rows, with direct links to the sampled records and a named person to present each area.
5. Check access: auditors may view records on screen; agree how they see sensitive records (for example HR screening outcomes only).

10.2 During the audit

• Keep the matrix open as the navigation aid; log each record shown and each request in an audit request log.
• When a record cannot be found, say so and note it, rather than improvising evidence.

10.3 For surveillance and recertification

• Surveillance audits sample part of Annex A each year, while some topics are covered at every surveillance. ISO/IEC 17021-1:2015 sets that list. As commonly summarised by accreditation bodies and auditor training material, it covers: internal audits and management review; review of action taken on nonconformities from the previous audit; handling of complaints; how effective the management system is at achieving the organization's objectives and intended results; progress of planned continual improvement; continuing operational control; changes; and use of certification marks or other references to certification. Have records for each of these ready every year, and confirm the exact list and wording in the standard and with your CB, whose audit programme decides what is sampled.
• Plan internal audits so that over the three-year cycle every applicable control has been audited at least once, and mark the audit date per control in a working column if helpful.
• Six weeks before each surveillance, run the readiness health check (isms/surveillance-readiness-health-check, DOC-ISMS-096) against the matrix.

11. Size tiers

12. Records and maintenance of the matrix

Maintenance rules:

• Update the matrix within [10] working days of any SoA change.
• Owners update "last collected" when they store a new record; the ISMS manager checks monthly and chases Due and Overdue rows.
• Align record names with the documented information register (DOC-ISMS-028) and the annual calendar (DOC-ISMS-032).
• Review the whole matrix with internal audit once a year.

13. References

Related templates: compliance/statement-of-applicability (DOC-ISMS-011), isms/stage-2-audit-evidence-index (DOC-ISMS-092), isms/isms-annual-calendar (DOC-ISMS-032), isms/isms-documented-information-register (DOC-ISMS-028), isms/isms-measurement-programme (DOC-ISMS-080), isms/surveillance-readiness-health-check (DOC-ISMS-096), isms/stage-1-readiness-pack (DOC-ISMS-091), compliance/internal-audit-program (DOC-ISMS-082), isms/isms-roles-raci (DOC-ISMS-006).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10 and the Annex A numbering of 93 controls in four themes. Only clause and control numbers are used; the short labels, suggested owners, records, frequencies and examples are original wording and are not the official control titles, control text or guidance. No ISO or IEC text is reproduced, and you need the official standards to apply them. ISO and IEC standards are copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition and amendments, and your certification body's rules, before use. This is a documentation format, not certification advice. Template licence: MIT.