# Control Evidence Matrix: [Organization name] ISMS

> One register that shows, for every requirement of ISO/IEC 27001:2022 +
> Amd 1:2024 clauses 4 to 10 and every one of the 93 Annex A controls,
> who owns the evidence, which record proves the requirement or control
> operates, where that record is kept, how often it is produced, when it
> was last collected and its status. It is the working index behind the
> Statement of Applicability (DOC-ISMS-011), the Stage 2 audit evidence
> index (DOC-ISMS-092) and every surveillance audit. Control labels are
> short descriptions written for this library, not official titles.
> Replace every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- When to use: as soon as the SoA has its first approved version.
  Build the matrix while controls are implemented, not in the month
  before the audit.
- Fill first: the owner and evidence columns for every applicable
  control, in the same order as the SoA. Then set up the locations
  (section 3) so each record has one home.
- The rows give a typical owner, record and frequency for each control
  as a starting point. They are suggestions: replace them with what
  your own policies and procedures actually require. Rows marked
  *Example* are completed for the fictional small company Quillmere
  Analytics Ltd to show the expected level of detail.
- Main pitfall: listing a policy as the evidence for a control. A
  policy shows intent; an auditor asks for the record that shows the
  control operated (a signed review, a log extract, a ticket, a test
  report) during the period.
- Keep applicability in step with the SoA: a control marked "No" in
  the SoA is "Not applicable" here, with the same reason.
- Related templates: `compliance/statement-of-applicability`,
  `isms/stage-2-audit-evidence-index`, `isms/isms-annual-calendar`,
  `isms/isms-documented-information-register`,
  `isms/surveillance-readiness-health-check`,
  `compliance/internal-audit-program`.
-->

## Document control

<!-- Guidance: The matrix changes often (last collected dates, statuses). Version the structure (owners, records, frequencies) formally; status updates can be tracked in the tool's history, with a snapshot frozen before each audit. -->

| Field | Value |
|---|---|
| Document ID | [DOC-ISMS-033] |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@internal-audit] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4 to 10, Annex A); control guidance ISO/IEC 27002:2022 |
| SoA version reflected | [DOC-ISMS-011 version x.y, dated YYYY-MM-DD] |
| ISMS scope reference | [DOC-ISMS-002] |
| Snapshot frozen for audit | [Stage 2 / Surveillance YYYY, snapshot date YYYY-MM-DD] |
| Next scheduled review | YYYY-MM-DD |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Chief information security officer | [@ciso] | [Reviewed] | YYYY-MM-DD |
| Internal audit | [@internal-audit] | [Reviewed for completeness] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First complete matrix aligned with SoA v1.0 |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Snapshot frozen for the Stage 2 audit; A.8.12 evidence changed to DLP alert review |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

1. Purpose and how the matrix works
2. Status values and frequency codes
3. Evidence locations
4. Clauses 4 to 10
5. Annex A organizational controls (A.5)
6. Annex A people controls (A.6)
7. Annex A physical controls (A.7)
8. Annex A technological controls (A.8)
9. Summary and health of the evidence
10. Using the matrix for Stage 2 and surveillance audits
11. Size tiers
12. Records and maintenance of the matrix
13. References

## 1. Purpose and how the matrix works

<!-- Guidance: Explain the matrix in a few lines so control owners understand what is expected. Questions: who updates "last collected", how often does the ISMS manager check it, and what happens when a record is overdue? -->

The matrix answers the question every auditor asks: "show me". For each
requirement and control it records:

- **Owner**: the role accountable for producing the evidence (usually
  the control owner named in DOC-ISMS-006).
- **Evidence**: the record type that proves operation, not only design.
- **Location**: where the record is kept, using the codes in section 3.
- **Frequency**: how often a new record is produced (codes in section 2).
- **Last collected**: date of the most recent record.
- **Status**: whether the evidence is current (section 2).

```mermaid
flowchart LR
  A["SoA decision (DOC-ISMS-011)"] --> B["Owner and record defined in matrix"]
  B --> C["Control operates and produces record"]
  C --> D["Record stored in its location"]
  D --> E["Owner updates last collected date"]
  E --> F{"Current for its frequency?"}
  F -- "Yes" --> G["Status: Collected"]
  F -- "No" --> H["Status: Due or Overdue"]
  H --> I["ISMS manager chases or raises action"]
  I --> C
  G --> J["Audit sampling (section 10)"]
```

## 2. Status values and frequency codes

<!-- Guidance: Use a small fixed set of values so the summary in section 9 can be counted. "Gap" means no record type exists yet: treat it as a finding to fix before Stage 2. -->

| Status | Meaning |
|---|---|
| Collected | A record exists for the current period and is stored in its location |
| Due | The next record is due within the next 30 days |
| Overdue | The record for the period was not produced on time |
| Gap | The control is applicable but no record type is defined or produced yet |
| Not applicable | Excluded in the SoA; the reason is in DOC-ISMS-011 section 5 |

| Code | Frequency |
|---|---|
| C | Continuous or per event (each joiner, change, incident) |
| M | Monthly |
| Q | Quarterly |
| H | Half-yearly |
| A | Annual |
| E | On a trigger only (change of scope, new supplier, new project) |

## 3. Evidence locations

<!-- Guidance: Give each storage location a code so rows stay short. Each location needs an owner, access control and a retention rule from the documented information register (DOC-ISMS-028). -->

| Code | Location | Owner | Typical retention *(Example)* |
|---|---|---|---|
| DMS | Document management system (policies, procedures, minutes, reports) | ISMS manager | Current plus superseded versions for 3 years |
| GRC | GRC tool or ISMS workbook (registers, risk, SoA, audit findings) | ISMS manager | 3 years |
| IDP | Identity provider and access governance exports | IT operations lead | 1 year of logs, reviews 3 years |
| TKT | Ticketing system (changes, access requests, incidents, actions) | IT operations lead | 3 years |
| HR | HR system (screening, contracts, training, leavers) | HR lead | Per employment law, as in DOC-ISMS-028 |
| LMS | Learning platform (awareness, training completion) | HR lead | 3 years |
| MDM | Endpoint and device management console | Endpoint lead | Monthly reports kept 1 year |
| VUL | Vulnerability scanner and remediation tracker (DOC-ISMS-072) | Vulnerability lead | 3 years |
| SIEM | Log management and security monitoring platform | Security operations lead | Logs [12 months], review records 3 years |
| CLD | Cloud provider consoles and posture tool reports | Cloud lead | 1 year of reports |
| REPO | Source code platform (reviews, pipelines, branch rules) | Engineering lead | Life of the repository |
| FAC | Facilities records (badges, visitor logs, CCTV retention, maintenance) | Facilities lead | Per local rules, CCTV [30 days] |

## 4. Clauses 4 to 10

<!-- Guidance: The management system clauses are audited at every Stage 2 and, for core items, at every surveillance. Several of them require documented information explicitly (see the canon list in the SoA template); the record named here must exist. -->

| Clause | Requirement (short label) | Owner | Evidence | Loc. | Freq. | Last collected | Status |
|---|---|---|---|---|---|---|---|
| 4.1 *(Example)* | Internal and external issues, including whether climate change is relevant | ISMS manager | Context register DOC-ISMS-003 with review record and climate change determination | DMS | A | 2027-04-06 | Collected |
| 4.2 | Interested parties and their requirements | ISMS manager | Interested parties table in DOC-ISMS-003 | DMS | A | YYYY-MM-DD | [status] |
| 4.3 | ISMS scope | ISMS manager | Approved scope DOC-ISMS-002 | DMS | A, E | YYYY-MM-DD | [status] |
| 4.4 | ISMS established and maintained | ISMS manager | Process map DOC-ISMS-004, ISMS manual DOC-ISMS-008 (optional) | DMS | A | YYYY-MM-DD | [status] |
| 5.1 | Leadership and commitment | Top management | Steering committee minutes, resource approvals | DMS | Q | YYYY-MM-DD | [status] |
| 5.2 *(Example)* | Information security policy | Top management | Approved policy DOC-ISMS-001, publication and acknowledgement records | DMS, LMS | A | 2027-05-12 | Collected |
| 5.3 | Roles, responsibilities and authorities | Top management | RACI DOC-ISMS-006, appointment records | DMS | A | YYYY-MM-DD | [status] |
| 6.1.1 | Actions to address risks and opportunities | ISMS manager | Risk and opportunity entries in the register | GRC | Q | YYYY-MM-DD | [status] |
| 6.1.2 | Risk assessment process | ISMS manager | Methodology DOC-ISMS-010, risk criteria DOC-ISMS-015 | DMS | A | YYYY-MM-DD | [status] |
| 6.1.3 | Risk treatment process and SoA | ISMS manager | Treatment plan DOC-ISMS-013, SoA DOC-ISMS-011, risk owner approvals | GRC | A, E | YYYY-MM-DD | [status] |
| 6.2 | Information security objectives | ISMS manager | Objectives register DOC-ISMS-024 with progress | GRC | Q | YYYY-MM-DD | [status] |
| 6.3 | Planning of changes to the ISMS | ISMS manager | Change plan DOC-ISMS-025 (good practice; no record is mandated) | DMS | E | YYYY-MM-DD | [status] |
| 7.1 | Resources | Top management | Budget and resource plan DOC-ISMS-031 | DMS | A | YYYY-MM-DD | [status] |
| 7.2 | Competence | HR lead | Competence matrix DOC-ISMS-026, certificates, training records | HR, LMS | A | YYYY-MM-DD | [status] |
| 7.3 | Awareness | HR lead | Awareness completion, policy acknowledgements | LMS | A, C | YYYY-MM-DD | [status] |
| 7.4 | Communication | ISMS manager | Communication plan DOC-ISMS-027 and sent communications | DMS | Q | YYYY-MM-DD | [status] |
| 7.5 | Documented information | ISMS manager | Documented information register DOC-ISMS-028, version history | DMS | Q | YYYY-MM-DD | [status] |
| 8.1 | Operational planning and control | ISMS manager | Annual calendar DOC-ISMS-032, outsourced process controls | DMS | A | YYYY-MM-DD | [status] |
| 8.2 | Risk assessments performed | ISMS manager | Risk assessment report DOC-ISMS-017, register snapshot | GRC | A, E | YYYY-MM-DD | [status] |
| 8.3 | Risk treatment implemented | ISMS manager | Treatment plan status, closure evidence per action | GRC | Q | YYYY-MM-DD | [status] |
| 9.1 *(Example)* | Monitoring, measurement, analysis and evaluation | ISMS manager | Measurement programme DOC-ISMS-080, performance report DOC-ISMS-081 | DMS | Q | 2027-07-21 | Collected |
| 9.2 | Internal audit | Internal audit lead | Audit programme DOC-ISMS-082, audit reports DOC-ISMS-084 | DMS | A | YYYY-MM-DD | [status] |
| 9.3 | Management review | Top management | Management review minutes DOC-ISMS-085 | DMS | A | YYYY-MM-DD | [status] |
| 10.1 | Continual improvement | ISMS manager | Improvement register DOC-ISMS-088 | GRC | Q | YYYY-MM-DD | [status] |
| 10.2 | Nonconformity and corrective action | ISMS manager | CAPA records DOC-ISMS-087, findings register DOC-ISMS-086 | GRC | C | YYYY-MM-DD | [status] |

## 5. Annex A organizational controls (A.5)

<!-- Guidance: One row per control, in Annex A order, using the same short labels as the SoA. The owner, evidence and frequency columns are suggestions. Replace them with your own and keep the record names identical to those in the annual calendar (DOC-ISMS-032). -->

| Control | Short label (not official title) | Owner | Evidence | Loc. | Freq. | Last collected | Status |
|---|---|---|---|---|---|---|---|
| A.5.1 *(Example)* | Information security policies | ISMS manager | Policy index DOC-ISMS-005 with review dates, approval records | DMS | A | 2027-05-12 | Collected |
| A.5.2 | Security roles and responsibilities | ISMS manager | RACI DOC-ISMS-006, job descriptions with security duties | DMS, HR | A | YYYY-MM-DD | [status] |
| A.5.3 | Segregation of duties | IT operations lead | Conflicting role matrix, access review exceptions | IDP | Q | YYYY-MM-DD | [status] |
| A.5.4 | Management responsibilities for security | Top management | Signed management commitments, briefing records | DMS | A | YYYY-MM-DD | [status] |
| A.5.5 | Contact with authorities | ISMS manager | Authority contact list DOC-ISMS-069, verification date | DMS | A | YYYY-MM-DD | [status] |
| A.5.6 | Contact with special interest groups | Security lead | Memberships and contact list in DOC-ISMS-069 | DMS | A | YYYY-MM-DD | [status] |
| A.5.7 *(Example)* | Threat intelligence (new in 2022) | Security lead | Monthly triage log and actions per DOC-ISMS-045 | GRC | M | 2027-08-02 | Collected |
| A.5.8 | Security in project management | Project office lead | Completed project security checklists DOC-ISMS-046 | DMS | C | YYYY-MM-DD | [status] |
| A.5.9 | Inventory of information and assets | IT operations lead | Asset inventory DOC-ISMS-012, reconciliation report | GRC | H | YYYY-MM-DD | [status] |
| A.5.10 | Acceptable use of information and assets | HR lead | AUP DOC-ISMS-040 acknowledgements | LMS | C, A | YYYY-MM-DD | [status] |
| A.5.11 | Return of assets | HR lead | Leaver checklists DOC-ISMS-053 with returned asset list | HR | C | YYYY-MM-DD | [status] |
| A.5.12 | Information classification | Data owner | Classification scheme, classified asset entries | DMS, GRC | A | YYYY-MM-DD | [status] |
| A.5.13 | Information labelling | Data owner | Labelling procedure DOC-ISMS-042, label coverage sample | DMS | A | YYYY-MM-DD | [status] |
| A.5.14 | Information transfer | Security lead | Transfer agreements, secure transfer tool logs (DOC-ISMS-043) | DMS, SIEM | Q | YYYY-MM-DD | [status] |
| A.5.15 | Access control rules | IAM lead | Access control policy DOC-ISMS-041, role definitions | DMS | A | YYYY-MM-DD | [status] |
| A.5.16 | Identity lifecycle management | IAM lead | Joiner, mover and leaver tickets reconciled with HR | TKT, IDP | M | YYYY-MM-DD | [status] |
| A.5.17 | Authentication information handling | IAM lead | MFA coverage report, password manager enrolment | IDP | M | YYYY-MM-DD | [status] |
| A.5.18 *(Example)* | Access rights provisioning and review | IT operations lead | Signed quarterly access reviews for 6 systems, removal tickets | IDP, TKT | Q | 2027-06-28 | Collected |
| A.5.19 | Security in supplier relationships | Procurement lead | Supplier register DOC-ISMS-066 with risk tier | GRC | A | YYYY-MM-DD | [status] |
| A.5.20 | Security in supplier agreements | Procurement lead | Signed security clauses or agreements DOC-ISMS-068 | DMS | E | YYYY-MM-DD | [status] |
| A.5.21 | ICT supply chain security | Engineering lead | Software bill of materials, dependency review records | REPO | C | YYYY-MM-DD | [status] |
| A.5.22 | Supplier service monitoring and change | Procurement lead | Annual supplier reviews DOC-ISMS-067, assurance reports | GRC | A | YYYY-MM-DD | [status] |
| A.5.23 *(Example)* | Security for cloud service use (new in 2022) | Cloud lead | Cloud policy DOC-ISMS-044, provider assurance report review, posture report | DMS, CLD | A, M | 2027-07-30 | Collected |
| A.5.24 | Incident management planning | Incident manager | Incident response plan DOC-ISMS-020, exercise record | DMS | A | YYYY-MM-DD | [status] |
| A.5.25 | Assessing security events | Security operations lead | Triage records with classification decisions | TKT, SIEM | C | YYYY-MM-DD | [status] |
| A.5.26 | Responding to security incidents | Incident manager | Incident register DOC-ISMS-021, incident tickets | TKT | C | YYYY-MM-DD | [status] |
| A.5.27 | Learning from incidents | Incident manager | Post-incident reviews DOC-ISMS-022, resulting actions | DMS, GRC | C | YYYY-MM-DD | [status] |
| A.5.28 | Evidence collection | Security operations lead | Evidence handling records, chain of custody forms | TKT | C | YYYY-MM-DD | [status] |
| A.5.29 | Security during disruption | Continuity lead | BCP DOC-ISMS-121 with security measures, tabletop report | DMS | A | YYYY-MM-DD | [status] |
| A.5.30 | ICT readiness for business continuity (new in 2022) | IT operations lead | ICT readiness plan DOC-ISMS-047, DR test report | DMS | A | YYYY-MM-DD | [status] |
| A.5.31 | Legal, regulatory and contractual requirements | Legal lead | Legal register DOC-ISMS-014 with review record | GRC | H | YYYY-MM-DD | [status] |
| A.5.32 | Intellectual property rights | Legal lead | Software licence inventory, open source licence scan | GRC, REPO | H | YYYY-MM-DD | [status] |
| A.5.33 | Protection of records | ISMS manager | Retention schedule, documented information register DOC-ISMS-028 | DMS | A | YYYY-MM-DD | [status] |
| A.5.34 *(Example)* | Privacy and PII protection | Privacy lead | Records of processing as processor, DPA register, DPIA log | GRC | H | 2027-07-15 | Due |
| A.5.35 | Independent review of security | ISMS manager | Independent review report DOC-ISMS-048 or internal audit report | DMS | A | YYYY-MM-DD | [status] |
| A.5.36 | Compliance with security policies and standards | Control owners | Compliance checks, configuration compliance reports, exceptions | GRC | Q | YYYY-MM-DD | [status] |
| A.5.37 | Documented operating procedures | IT operations lead | Approved operating procedures DOC-ISMS-049 with review dates | DMS | A | YYYY-MM-DD | [status] |

## 6. Annex A people controls (A.6)

<!-- Guidance: People controls rely on HR records. Agree with HR which personal data the ISMS may see: an auditor can sample a joiner and a leaver without reading full personnel files. -->

| Control | Short label (not official title) | Owner | Evidence | Loc. | Freq. | Last collected | Status |
|---|---|---|---|---|---|---|---|
| A.6.1 | Pre-employment screening | HR lead | Screening completion records per DOC-ISMS-050 (outcome only) | HR | C | YYYY-MM-DD | [status] |
| A.6.2 | Security terms in employment contracts | HR lead | Signed contracts or terms with security clauses (sample list) | HR | C | YYYY-MM-DD | [status] |
| A.6.3 *(Example)* | Awareness, education and training | HR lead | Learning platform completion 45 of 46 staff (98%), phishing results | LMS | A, Q | 2027-07-25 | Collected |
| A.6.4 | Disciplinary process | HR lead | Disciplinary process DOC-ISMS-052, case log (anonymised count) | HR | A | YYYY-MM-DD | [status] |
| A.6.5 | Duties after leaving or changing role | HR lead | Leaver reminders of continuing duties, signed exit forms | HR | C | YYYY-MM-DD | [status] |
| A.6.6 | Confidentiality agreements | Legal lead | Signed NDAs DOC-ISMS-051, NDA review record | HR, DMS | C, A | YYYY-MM-DD | [status] |
| A.6.7 | Remote working | IT operations lead | Remote working policy DOC-ISMS-054 acknowledgements, device compliance | LMS, MDM | A, M | YYYY-MM-DD | [status] |
| A.6.8 | Reporting security events | Security operations lead | Event reports received, reporting channel test | TKT | C | YYYY-MM-DD | [status] |

## 7. Annex A physical controls (A.7)

<!-- Guidance: Where facilities are run by a landlord, colocation provider or cloud provider, the evidence is your review of their assurance (contract, report, site assessment) plus your own controls for the areas you manage. Say which applies in the evidence column. -->

| Control | Short label (not official title) | Owner | Evidence | Loc. | Freq. | Last collected | Status |
|---|---|---|---|---|---|---|---|
| A.7.1 | Physical security perimeters | Facilities lead | Site security plan, perimeter inspection record | FAC | A | YYYY-MM-DD | [status] |
| A.7.2 | Physical entry controls | Facilities lead | Badge access list reviews, visitor logs | FAC | Q | YYYY-MM-DD | [status] |
| A.7.3 | Securing offices, rooms and facilities | Facilities lead | Room access design, lock and key register | FAC | A | YYYY-MM-DD | [status] |
| A.7.4 *(Example)* | Physical security monitoring (new in 2022) | Facilities lead | Office CCTV retention check, alarm test record; data centres via provider report | FAC, DMS | Q | 2027-05-20 | Overdue |
| A.7.5 | Protection against physical and environmental threats | Facilities lead | Environmental risk assessment, fire system inspection | FAC | A | YYYY-MM-DD | [status] |
| A.7.6 | Working in secure areas | Facilities lead | Secure area rules, access log review | FAC | Q | YYYY-MM-DD | [status] |
| A.7.7 | Clear desk and clear screen | Facilities lead | Clear desk spot-check results DOC-ISMS-056, screen lock settings | FAC, MDM | Q | YYYY-MM-DD | [status] |
| A.7.8 | Equipment siting and protection | IT operations lead | Equipment room inspection, rack inventory | FAC | A | YYYY-MM-DD | [status] |
| A.7.9 | Assets used off-premises | IT operations lead | Laptop encryption and tracking reports, loss reports | MDM | M | YYYY-MM-DD | [status] |
| A.7.10 | Storage media | IT operations lead | Removable media control settings, media register | MDM, GRC | Q | YYYY-MM-DD | [status] |
| A.7.11 | Supporting utilities | Facilities lead | UPS and generator test records, provider reports | FAC | H | YYYY-MM-DD | [status] |
| A.7.12 | Cabling security | Facilities lead | Cabling inspection record, cabinet lock check | FAC | A | YYYY-MM-DD | [status] |
| A.7.13 | Equipment maintenance | IT operations lead | Maintenance logs and contracts | FAC, TKT | C | YYYY-MM-DD | [status] |
| A.7.14 | Secure disposal or re-use of equipment | IT operations lead | Disposal and reuse records DOC-ISMS-057, wipe certificates | GRC | C | YYYY-MM-DD | [status] |

## 8. Annex A technological controls (A.8)

<!-- Guidance: Most technological evidence comes from tools. Name the report and keep a dated export for the audit period: dashboards change and cannot show what was true six months ago. -->

| Control | Short label (not official title) | Owner | Evidence | Loc. | Freq. | Last collected | Status |
|---|---|---|---|---|---|---|---|
| A.8.1 *(Example)* | User endpoint devices | Endpoint lead | MDM compliance export (encryption, OS version, screen lock) for all managed laptops | MDM | M | 2027-08-01 | Collected |
| A.8.2 | Privileged access rights | IAM lead | Privileged account review, approval tickets | IDP, TKT | Q | YYYY-MM-DD | [status] |
| A.8.3 | Restricting access to information | IAM lead | Role-based access configuration export, review results | IDP | Q | YYYY-MM-DD | [status] |
| A.8.4 | Access to source code | Engineering lead | Repository access list review, branch protection settings | REPO | Q | YYYY-MM-DD | [status] |
| A.8.5 | Secure authentication | IAM lead | MFA and single sign-on coverage report | IDP | M | YYYY-MM-DD | [status] |
| A.8.6 | Capacity management | IT operations lead | Capacity reviews and alerts, capacity plan | CLD, DMS | Q | YYYY-MM-DD | [status] |
| A.8.7 | Protection against malware | Endpoint lead | Anti-malware or EDR coverage and alert report (DOC-ISMS-059) | MDM, SIEM | M | YYYY-MM-DD | [status] |
| A.8.8 | Technical vulnerability management | Vulnerability lead | Scan reports, remediation tracker DOC-ISMS-072, penetration test report | VUL | M, A | YYYY-MM-DD | [status] |
| A.8.9 *(Example)* | Configuration management (new in 2022) | Cloud lead | Baseline DOC-ISMS-060, posture tool drift report, 2 high findings open | CLD | M | 2027-08-01 | Collected |
| A.8.10 | Information deletion (new in 2022) | Data owner | Deletion job logs, customer data deletion confirmations | TKT, CLD | C | YYYY-MM-DD | [status] |
| A.8.11 | Data masking (new in 2022) | Engineering lead | Masking rules, test data generation records (DOC-ISMS-062) | REPO | Q | YYYY-MM-DD | [status] |
| A.8.12 | Data leakage prevention (new in 2022) | Security operations lead | DLP policy configuration, alert review records | SIEM | M | YYYY-MM-DD | [status] |
| A.8.13 | Information backup | IT operations lead | Backup job reports, restore test log DOC-ISMS-071 | CLD, GRC | M, Q | YYYY-MM-DD | [status] |
| A.8.14 | Redundancy of processing facilities | IT operations lead | Architecture diagram, failover test report | DMS | A | YYYY-MM-DD | [status] |
| A.8.15 | Logging | Security operations lead | Log source coverage list, retention settings | SIEM | Q | YYYY-MM-DD | [status] |
| A.8.16 | Monitoring activities (new in 2022) | Security operations lead | Alert handling records, monthly monitoring review (DOC-ISMS-064) | SIEM | M | YYYY-MM-DD | [status] |
| A.8.17 | Clock synchronization | IT operations lead | Time source configuration export | CLD | A | YYYY-MM-DD | [status] |
| A.8.18 | Use of privileged utility programs | IT operations lead | Restricted utility list, usage logs | SIEM | Q | YYYY-MM-DD | [status] |
| A.8.19 | Software installation on operational systems | IT operations lead | Allowed software list, change tickets for installs | TKT, MDM | Q | YYYY-MM-DD | [status] |
| A.8.20 | Network security | Network lead | Network security standard DOC-ISMS-063, firewall rule review | DMS, TKT | H | YYYY-MM-DD | [status] |
| A.8.21 | Security of network services | Network lead | Network service agreements, provider security review | DMS | A | YYYY-MM-DD | [status] |
| A.8.22 | Network segregation | Network lead | Segmentation diagram, rule review results | DMS | H | YYYY-MM-DD | [status] |
| A.8.23 | Web filtering (new in 2022) | Endpoint lead | Web filtering policy settings, block report | MDM | Q | YYYY-MM-DD | [status] |
| A.8.24 | Use of cryptography | Platform lead | Key and certificate register DOC-ISMS-070, rotation tickets | GRC, TKT | A, M | YYYY-MM-DD | [status] |
| A.8.25 | Secure development life cycle | Engineering lead | Secure development policy DOC-ISMS-065, release checklists | DMS, REPO | C | YYYY-MM-DD | [status] |
| A.8.26 | Application security requirements | Engineering lead | Security requirements in design records or tickets | TKT | C | YYYY-MM-DD | [status] |
| A.8.27 | Secure architecture and engineering principles | Engineering lead | Architecture principles, design review records, threat models | DMS | C | YYYY-MM-DD | [status] |
| A.8.28 | Secure coding (new in 2022) | Engineering lead | Code review records, static analysis results in pipelines | REPO | C | YYYY-MM-DD | [status] |
| A.8.29 | Security testing in development and acceptance | Engineering lead | Pipeline security test results, acceptance test sign-off | REPO | C | YYYY-MM-DD | [status] |
| A.8.30 *(Example)* | Outsourced development | Procurement lead | Not applicable: no outsourced development (SoA section 5); supplier register confirms | GRC | E | 2027-05-12 | Not applicable |
| A.8.31 | Separation of development, test and production | Engineering lead | Environment separation diagram, access lists per environment | DMS, IDP | A | YYYY-MM-DD | [status] |
| A.8.32 | Change management | IT operations lead | Approved change tickets, emergency change reviews | TKT | C | YYYY-MM-DD | [status] |
| A.8.33 | Test information | Engineering lead | Test data approvals, masking evidence | TKT, REPO | C | YYYY-MM-DD | [status] |
| A.8.34 | Protecting systems during audit testing | ISMS manager | Approved test plans for audits and penetration tests | DMS | E | YYYY-MM-DD | [status] |

## 9. Summary and health of the evidence

<!-- Guidance: Count the statuses after each update. The totals per theme must equal the number of controls (37, 8, 14, 34; 93 in all), or a row is missing. Report the summary in the performance report (DOC-ISMS-081). -->

| Theme | Controls | Collected | Due | Overdue | Gap | Not applicable |
|---|---|---|---|---|---|---|
| A.5 Organizational | 37 | [n] | [n] | [n] | [n] | [n] |
| A.6 People | 8 | [n] | [n] | [n] | [n] | [n] |
| A.7 Physical | 14 | [n] | [n] | [n] | [n] | [n] |
| A.8 Technological | 34 | [n] | [n] | [n] | [n] | [n] |
| **Total** | **93** | [n] | [n] | [n] | [n] | [n] |

Worked summary for Quillmere Analytics Ltd *(Example)*, eight weeks
before Stage 2:

| Theme | Controls | Collected | Due | Overdue | Gap | Not applicable |
|---|---|---|---|---|---|---|
| A.5 Organizational *(Example)* | 37 | 31 | 4 | 1 | 1 | 0 |
| A.6 People *(Example)* | 8 | 7 | 1 | 0 | 0 | 0 |
| A.7 Physical *(Example)* | 14 | 12 | 1 | 1 | 0 | 0 |
| A.8 Technological *(Example)* | 34 | 29 | 2 | 1 | 1 | 1 |
| **Total** | **93** | **79** | **8** | **3** | **2** | **1** |

Reading the example: 79 of the 92 applicable controls (86%) have current
evidence. The 3 overdue and 2 gap items are the priority list for the
next four weeks; each gets an owner and a date in the risk treatment
plan or the corrective action log.

Useful indicators for the measurement programme (DOC-ISMS-080):
percentage of applicable controls with current evidence, number of
overdue records older than one period, and number of gaps.

## 10. Using the matrix for Stage 2 and surveillance audits

<!-- Guidance: The certification body decides what it samples. Your job is to be able to produce any record quickly and to show that records cover the whole period since the last audit, not just the last week. -->

### 10.1 Before Stage 2

1. Freeze a snapshot of the matrix about [4 to 6] weeks before the
   audit and record the snapshot date in Document control.
2. Make sure every applicable control has at least one record from the
   period the ISMS has operated, and every clause 4 to 10 row has its
   record. Certification bodies usually expect one full internal audit of
   the ISMS and one management review before Stage 2 (CB practice, not
   a clause).
3. Close or plan every Gap. A Gap on a control marked "Implemented" in
   the SoA is a contradiction an auditor will find.
4. Build the Stage 2 audit evidence index (`isms/stage-2-audit-evidence-index`,
   DOC-ISMS-092) from the matrix: same rows, with direct links to the
   sampled records and a named person to present each area.
5. Check access: auditors may view records on screen; agree how they
   see sensitive records (for example HR screening outcomes only).

### 10.2 During the audit

- Keep the matrix open as the navigation aid; log each record shown and
  each request in an audit request log.
- When a record cannot be found, say so and note it, rather than
  improvising evidence.

### 10.3 For surveillance and recertification

- Surveillance audits sample part of Annex A each year, while some
  topics are covered at every surveillance. ISO/IEC 17021-1:2015 sets
  that list. As commonly summarised by accreditation bodies and
  auditor training material, it covers: internal audits and management
  review; review of action taken on nonconformities from the previous
  audit; handling of complaints; how effective the management system is
  at achieving the organization's objectives and intended results;
  progress of planned continual improvement; continuing operational
  control; changes; and use of certification marks or other references
  to certification. Have records for each of these ready every year,
  and confirm the exact list and wording in the standard and with your
  CB, whose audit programme decides what is sampled.
- Plan internal audits so that over the three-year cycle every
  applicable control has been audited at least once, and mark the
  audit date per control in a working column if helpful.
- Six weeks before each surveillance, run the readiness health check
  (`isms/surveillance-readiness-health-check`, DOC-ISMS-096) against
  the matrix.

```mermaid
stateDiagram-v2
  [*] --> Gap
  Gap --> Collected: record type defined and produced
  Collected --> Due: within 30 days of next due date
  Due --> Collected: new record stored
  Due --> Overdue: due date passed
  Overdue --> Collected: record produced late, cause recorded
  Collected --> NotApplicable: SoA excludes control
  NotApplicable --> Gap: SoA includes control again
```

## 11. Size tiers

<!-- Guidance: All organisations need evidence for every applicable control; what changes is the number of owners, systems and sites, and how much the matrix can be automated. The settings are the library's fictional examples. -->

| Aspect | Small: Quillmere Analytics Ltd *(Example)* | Medium: Quillmere Health Systems *(Example)* | Large: Quillmere Group *(Example)* |
|---|---|---|---|
| Profile | 46 staff, SaaS on one public cloud in two regions, part-time ISMS manager (0.5 FTE) | 320 staff, two offices, one colocation suite, ISMS manager plus 3-person security team | 2,400 staff, 6 sites in 4 countries, IT and OT, CISO with a 14-person security office |
| Tool | One spreadsheet tab per theme, records in the document system and cloud tools | GRC tool with owners assigned per row and reminders | GRC platform with one matrix per site rolled up to group, shared rows for group-wide controls |
| Owners | About 8 people; the ISMS manager owns many organizational rows | About 25 control owners across IT, HR, facilities, legal and engineering | Group control owners for shared controls plus site owners for local controls (physical, OT, local HR) |
| Physical rows | Office only; data centre evidence is the cloud provider's assurance report review | Offices plus the colocation suite (provider report and own cage controls) | Each plant, service centre and the data centre with their own records |
| Automation | Manual exports monthly | Scheduled exports for identity, endpoint and vulnerability data | Integrations pull status from identity, endpoint, SIEM and ticketing tools |
| Review | ISMS manager monthly | ISMS manager monthly, steering committee quarterly | Site coordinators monthly, group security office quarterly, integrated with ISO 9001 and ISO 22301 evidence where controls overlap |

## 12. Records and maintenance of the matrix

<!-- Guidance: The matrix is itself documented information. Keep frozen snapshots for each audit so you can show what was presented, and keep the change history of owners and records. -->

| Record | Proves | Kept by | Location | Retention *(Example)* |
|---|---|---|---|---|
| Current matrix | Evidence ownership and status at any time | ISMS manager | GRC | Current |
| Audit snapshots (Stage 2, each surveillance, recertification) | What was presented to the certification body | ISMS manager | DMS, read-only | 3 years after the snapshot, or one full cycle |
| Change history of owners, records and frequencies | Controlled changes to the evidence model | ISMS manager | GRC history or revision table | 3 years |
| Monthly status summaries | Evidence health over time | ISMS manager | Performance report DOC-ISMS-081 | 3 years |

Maintenance rules:

- Update the matrix within [10] working days of any SoA change.
- Owners update "last collected" when they store a new record; the
  ISMS manager checks monthly and chases Due and Overdue rows.
- Align record names with the documented information register
  (DOC-ISMS-028) and the annual calendar (DOC-ISMS-032).
- Review the whole matrix with internal audit once a year.

## 13. References

<!-- Guidance: Use the official texts to check each control's intent before you choose its evidence. The labels here are not the official titles. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | https://www.iso.org/standard/82875.html ; https://www.iso.org/standard/88435.html | Clauses 4 to 10, Annex A control numbering (93 controls in 4 themes) |
| ISO/IEC 27002:2022 | https://www.iso.org/standard/75652.html | Control purpose and guidance used to choose evidence |
| ISO/IEC 17021-1:2015 | https://www.iso.org/standard/61651.html | Stage 1, Stage 2, surveillance and recertification audits |
| ISO/IEC 27006-1:2024 | https://www.iso.org/standard/82908.html | ISMS certification audit requirements for certification bodies |
| ISO/IEC 27007:2020 | https://www.iso.org/standard/77802.html | ISMS auditing guidance; under revision |

Related templates: `compliance/statement-of-applicability`
(DOC-ISMS-011), `isms/stage-2-audit-evidence-index` (DOC-ISMS-092),
`isms/isms-annual-calendar` (DOC-ISMS-032),
`isms/isms-documented-information-register` (DOC-ISMS-028),
`isms/isms-measurement-programme` (DOC-ISMS-080),
`isms/surveillance-readiness-health-check` (DOC-ISMS-096),
`isms/stage-1-readiness-pack` (DOC-ISMS-091),
`compliance/internal-audit-program` (DOC-ISMS-082),
`isms/isms-roles-raci` (DOC-ISMS-006).

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 4 to 10
and the Annex A numbering of 93 controls in four themes. Only clause
and control numbers are used; the short labels, suggested owners,
records, frequencies and examples are original wording and are not the
official control titles, control text or guidance. No ISO or IEC text
is reproduced, and you need the official standards to apply them. ISO
and IEC standards are copyrighted and sold by ISO, IEC and national
standards bodies. Check the current edition and amendments, and your
certification body's rules, before use. This is a documentation
format, not certification advice. Template licence: MIT.