Stop Preparing Evidence for Your ISO 27001 Audit

This article is based on an episode from the Cyber & AI Perspectives podcast. Prefer listening instead? Listen to the audio version below.

For many companies that go for ISO 27001 certification, the main question they have is: “How do we prepare the evidence?” I believe this is the completely wrong approach, not only to security but also to certification audits.

How an ISO 27001 certification audit works

Let me first explain how the certification audit works. The initial certification audit is divided into two stages, Stage 1 and Stage 2, and after certification, surveillance audits are performed to check whether you are maintaining your ISMS.

Stage 1 is informally called the “document review.” Among other things, this is where the auditors read through the policies, procedures, and other security documents that the company has written. The purpose of this review is to find out if those documents are compliant with the standard, but more importantly, this is a way for the auditors to learn how the company handles security; in other words, how it carries out various security activities and processes.

This is important because ISO 27001 does not require different companies to perform, for example, backup in exactly the same way. Rather, it requires them to perform security controls in a way that is appropriate for their risks. So, one company might perform backup every 24 hours, while another might do it every hour because the criticality of their data is very different.

So, for the auditors to be able to assess if the company is performing backup properly, first they need to learn the company’s own internal requirements for backup.

How auditors collect evidence

Stage 1 is more about preparation and is more theoretical, whereas Stage 2 is about executing the audit and is very hands on. In Stage 2, the auditors will be looking for evidence that the company is compliant not only with the standard, but also with its own security policies and procedures.

The auditors will primarily use three methods for collecting evidence:

• written evidence, which is typically in the form of logs and records — for example, backup logs;
• visual evidence, where the auditor personally observes how things are done — for example, where the security cameras are located; and
• verbal evidence, where the auditor interviews employees in order to find out how things are done in real life — for example, the auditor might ask several employees how they protect their laptops when using public transportation.

What companies get wrong about audit evidence

Here are three things that companies often misunderstand about these audits.

First, companies need to comply with their own policies and procedures, not only with the standard, in order to pass the certification.
Second, most problems — or nonconformities, as the auditors call them — will not be because of the standard itself, but will be related to those policies and procedures. Usually, this is where more than 75% of nonconformities come from. This means that, in most cases, companies will be compliant with the standard, but not with their own rules.

And the third, and probably the most important: Companies do not need to manufacture separate evidence for the auditor, and they do not need to create a repository of evidence for auditors to access.

Rather, in most cases, the evidence will be created naturally as a result of performing security activities. For example, the backup system will create backup logs as evidence that backups are being performed. Companies do not need to move this evidence somewhere else just for the audit. When auditors want to audit the backup process, they will ask to see those backup logs.

By the way, part of this focus on evidence comes from Governance, Risk, and Compliance (GRC) tools that use the same approach for ISO 27001 as they do for SOC 2. But audits for these two standards work differently. In a SOC 2 audit, a repository of evidence plays a much bigger role, whereas ISO 27001 auditors rely on evidence they collect at the place where security activities are happening.

“Push” vs. “pull” approach

I’m not saying that evidence is not important. On the contrary, evidence is crucial for the ISO 27001 certification auditor to find out if the company is compliant with the standard or not.

What I’m saying is that this “push” approach to evidence by companies is wrong. Instead, they should focus on good security processes and allow the auditors to “pull” the evidence based on those processes.

Evidence does not improve your security

But focusing on evidence has an even bigger problem: Evidence itself does not improve your security. When you think about it, security will improve if you assess the risks properly, decide which controls are adequate, and then execute those controls thoroughly.

For example, you might have critical data about financial transactions, and this is why you decide that doing a backup every hour is necessary. Then you make sure that this is really being done, 24 hours a day, 365 days a year.

Build security processes, not evidence

And to be able to be so consistent, you need to have security processes set up — first for assessing risks, then for making decisions on which controls are necessary, and finally for performing those controls in practice. For example, for backup, you will need to have a process for configuring the backup system, for monitoring how it works, for updating and patching it, for testing the restoration of backup copies, and so on.

If you do not set up those processes, your security might look strong on paper, but it will be fragile in practice — and sooner or later, something will break down. And when I say setting up processes, this doesn’t mean writing policies or procedures for each process. Rather, it means making sure that these activities are performed regularly and properly.

Smaller companies will often have security processes that are not formally documented, which is fine in most cases. And this is exactly why auditors are not only looking at your records. They are also observing who is doing what and, more importantly, speaking to people in your company to find out how things are actually done and whether everyone is telling the same story.

Let the evidence follow

So, if you’re preparing for ISO 27001 certification, do not ask: “How do we prepare the evidence?” Instead, ask: “Are our security processes actually working?”

If your risks are assessed properly, your controls are appropriate, people know what they need to do, and those controls are consistently performed and monitored, the evidence will largely already be there. Build the security processes first, and let the evidence follow. After all, cybersecurity is about becoming more secure. It is not about creating evidence.

See also my interview with Aron Lange, where he speaks about what certification auditors are looking for and how this focus on evidence is leading companies in the wrong direction.

To learn more about ISO 27001 certification audits, check out the podcast episode “ISO 27001 Certification: What Will the Auditor Look For?” where Aron explains how this focus on evidence is leading companies in the wrong direction.