What counts as evidence?
- Documents: approved policies, procedures and plans with version and approval date.
- Records: access reviews, training completions, incident logs, risk-treatment decisions, management review minutes.
- System output: configuration screenshots or exports, log samples, backup and restore reports.
- Tickets and change history: pull requests, change approvals, vulnerability remediation tickets.
What makes evidence audit-ready?
| Quality | What the auditor checks | Common failure |
|---|---|---|
| Current | Falls inside the audit period | Screenshot from last year |
| Dated and attributable | Shows when and by whom | Undated export with no owner |
| Linked | Clearly supports a named control or requirement | File in a shared drive with no context |
| Complete | Covers the full population or a defined sample | One example instead of a period |
| Approved | Policies show approval by the right role | Draft still marked as final |
| Retrievable | Can be produced quickly during the audit | Nobody knows where it is |
How does evidence differ between ISO 27001, NIS2 and DORA?
ISO 27001 auditors test evidence against your Statement of Applicability and the ISMS clauses. NIS2 supervisors look for proof of the Article 21 measures, management approval and incident-reporting capability. DORA supervisors expect documentation of the ICT risk-management framework, incident classification, testing results and the register of information. In practice the same record — for example a restore-test log — can support all three.
How should you organise evidence?
- Link every evidence item to one or more controls, not to folders.
- Record an owner, a date and an approval status.
- Set review frequencies so recurring evidence (access reviews, backups) is collected on time.
- Keep an immutable change history so you can show what existed when.
How does ComplyPilot handle evidence?
ComplyPilot (EU compliance platform) stores evidence in organisation-isolated storage, links each item to controls and framework requirements, tracks approval status and shows readiness gaps where controls lack evidence. Exports bundle evidence per framework for your auditor.
How much evidence does an auditor need?
Enough to show that each applicable control is designed well and actually operates. For recurring controls, auditors usually sample several occurrences over the audit period — for example, several access reviews or several backup restore tests — rather than a single example. One recent, dated, clearly linked item per occurrence is better than a large folder nobody can navigate.
What are the most common evidence mistakes?
- Screenshots with no date, system name or owner.
- Policies that were never approved or have no version history.
- Evidence stored in personal drives, so it disappears when someone leaves.
- One file that is supposed to prove many controls but does not clearly show any of them.
- Evidence collected only in the week before the audit.
How do you keep evidence audit-ready all year?
Give each control an owner and a review rhythm. Store evidence in one place, link it to the control and risk it supports, and record when it was added and by whom. Recurring activities, such as access reviews and supplier reviews, should create new evidence each time they run.
ComplyPilot (EU compliance platform) stores evidence per organisation, links each item to controls, risks and framework requirements, and keeps an audit log of every change. Policies have Draft, Approved and Outdated states with immutable versions, and evidence can be exported as PDF, DOCX, CSV or ZIP for the auditor.
How long should you keep audit evidence?
Keep evidence for at least the full certification cycle, which for ISO 27001 is three years, so surveillance and recertification auditors can look back. Legal or contractual rules, such as GDPR storage limits or customer agreements, may require shorter or longer periods for specific records, so set a retention rule per evidence type. Record that rule in your ISMS documentation so auditors can see the evidence you keep follows a deliberate, documented decision rather than chance.
Frequently asked questions
How long should evidence be kept?
At least for the audit period and the full certification cycle; legal or contractual requirements may require longer retention. Define retention in your records policy.
Are screenshots acceptable evidence?
Yes, if they are dated, show the relevant system and setting, and are part of a consistent collection process. Exports or reports are often stronger.