Evidence Collection Checklist

Purpose

This checklist helps prepare evidence for internal audits and external ISO 27001 certification audits. It identifies what records to collect, where to find them, and how to organise them.

Use this checklist:

• 4 weeks before internal audit
• 8 weeks before external certification audit
• Continuously (collect evidence as you go)

General Principles

Evidence Types

Documentary Evidence: Policies, procedures, records Physical Evidence: Configurations, system settings (screenshots) Testimonial Evidence: Interviews, explanations (during audit)

Quality of Evidence

Good evidence is:

• Relevant. Directly demonstrates control implementation
• Current. Recent enough to show ongoing compliance
• Complete. Shows the full process, not just one instance
• Objective. Factual records, not just assertions

Evidence Organisation

Recommended structure:

Audit-Evidence-YYYY-MM/
├── 01-Policies/
├── 02-Risk-Management/
├── 03-Operational-Security/
├── 04-Access-Control/
├── 05-Cryptography/
├── 06-SDLC-Security/
├── 07-Incident-Response/
├── 08-Records/
└── README.md (index of all evidence)

Clause 4: Context of the Organisation

Action: Export latest versions as PDF, include git log showing last review date.

Clause 5: Leadership

Action: Show management review minutes demonstrating leadership engagement. Export policy with approval date.

Clause 6: Planning

Action: Show risk register is current (updated within last 3 months). Demonstrate objectives are measured (metrics).

Clause 7: Support

Action:

• Collect training completion records (who, when, topic)
• Screenshot GitHub org members (demonstrates resourcing)
• Export ISMS documentation with version history

Clause 8: Operation

Action: Show procedures are followed (sample 5 changes, verify they followed change management process).

Clause 9: Performance Evaluation

Action:

• Compile security metrics (incidents, vulnerabilities, training)
• Include completed internal audit report with findings and corrective actions
• Include management review minutes

Clause 10: Improvement

Action: Show examples of improvements made (e.g., SOA controls moving from “Planned” to “Implemented”).

Annex A Controls: Selected Examples

A.5.1: Policies for Information Security

A.5.15: Access Control

Action: Screenshot GitHub “People” page showing MFA status. Export Cloudflare user list. Provide last access review.

A.5.24: Incident Management Planning and Preparation

Action: If no real incidents, document a tabletop exercise (simulated incident, how we’d respond).

A.5.31: Legal, Statutory, Regulatory and Contractual Requirements

Action: Export Cloudflare/GitHub contract terms. Document zero knowledge architecture as privacy compliance strategy.

A.8.3: Management of Technical Vulnerabilities

Action: Screenshot GitHub security overview (vulnerabilities, Dependabot). Export sample vulnerability → patch → merge timeline.

A.8.9: Configuration Management

Action: Show wrangler.toml in Git. Show sample PR changing configuration (review, approval, CI).

A.8.23: Web Filtering

Status: Not Applicable (no corporate network)

Evidence: N/A justification documented in SOA

A.8.24: Use of Cryptography

Action: Export cryptography policy. Show JWKS (public keys). Provide audit log entry for last key rotation.

Operational Evidence

Secure Development Lifecycle

Action:

• Screenshot GitHub branch protection (require review, passing CI)
• Export CI workflow files (show CodeQL, cargo audit, npm audit)
• Show SLSA provenance on a recent release

Logging and Monitoring

Action: Screenshot Grafana Loki dashboard for the Workers Logs sink. Provide sample audit log entry (redacted if needed).

Business Continuity

Action: Document last incident that tested BC plan (or conduct tabletop exercise).

Supplier Management

Action: Export supplier contracts. Screenshot Cloudflare/GitHub status pages (monitoring evidence).

Records to Maintain Ongoing

Access Control

• GitHub organisation members list (quarterly)
• Cloudflare account users list (quarterly)
• Access review completion records (quarterly)
• Onboarding checklists (per hire)
• Offboarding checklists (per departure)

Training

1. Training completion records (per person, per training)
2. Training acknowledgment forms
3. Training content (slides, videos, documentation links)

Risk Management

1. Risk assessment records (quarterly)
2. Risk register updates (quarterly)
3. Risk treatment plans (per risk)

Incident Response

1. Incident reports (per incident)
2. Incident postmortems (per P0/P1 incident)
3. Incident log (all incidents)

Change Management

1. Pull requests (all changes)
2. Deployment logs (wrangler CLI output, GitHub Actions)
3. Emergency change log (if any emergency changes)

Cryptography

• Key generation ceremonies (per key)
• Key rotation records (annually)
• JWKS updates (per rotation)
• Key status transitions (Active → Deprecated → Disabled)

Audits

1. Internal audit reports (annually)
2. Corrective action register (ongoing)
3. Management review minutes (quarterly)

Evidence Sources

GitHub

What to export:

• Organisation settings (screenshot: MFA required, members, teams)
• Branch protection rules (screenshot)
• Security overview (vulnerabilities, Dependabot)
• Recent pull requests (showing code review, CI passing)
• GitHub Actions workflow files (CI/CD)
• GitHub Actions run logs (security scans passing)
• Audit log (access provisioning/revocation)

How:

• GitHub UI → Organisation Settings → Security & Analysis
• GitHub UI → Repository → Insights → Security
• git log for commit history

Cloudflare

What to export:

• Account users (screenshot)
• Workers deployments (wrangler CLI logs)
• KV namespaces (list, not contents)
• Analytics (uptime, traffic)
• Security events (if any)

How:

• Cloudflare Dashboard → Account → Members
• wrangler whoami (authentication)
• Cloudflare Dashboard → Analytics

Local Systems

What to export:

• Training records (spreadsheet: who, what, when, status)
• Incident log (spreadsheet or issue tracker)
• Risk register (current version from docs)
• Management review minutes (document)
• Internal audit report (document)

How:

• Maintain in Google Docs, GitHub Issues, or simple spreadsheet
• Export as PDF for audit

Audit Preparation Timeline

8 Weeks Before External Audit

• Review this checklist
• Identify gaps in evidence
• Start collecting missing evidence
• Update ISMS documentation (if outdated)

4 Weeks Before

• Complete evidence collection
• Organise evidence into folders
• Create evidence index (README)
• Conduct mock internal audit
• Address any findings from mock audit

2 Weeks Before

• Finalize evidence package
• Share evidence index with auditor (if pre-audit review)
• Prepare team for interviews
• Review ISMS documents (everyone knows where to find things)

1 Week Before

1. Confirm evidence access (can auditor access GitHub, Cloudflare if needed?)
2. Confirm audit logistics (date, time, attendees, agenda)
3. Final check: all documents current

During Audit

• Provide evidence as requested
• Take notes on findings
• Ask questions if unclear
• Professional, honest, transparent

After Audit

• Review findings
• Develop corrective action plans
• Implement corrective actions
• Verify effectiveness
• Document lessons learned

Tips for Effective Evidence

Do:

• Keep evidence up-to-date (don’t scramble before audit)
• Organise evidence logically (auditor can find what they need)
• Use timestamps (show when actions occurred)
• Be honest (if something isn’t done, say so, don’t fabricate)

Don’t:

• Create evidence just for the audit (auditor will see through it)
• Provide more evidence than requested (stay focused)
• Hide weaknesses (auditor will find them anyway, honesty builds trust)

Related Documents

1. Internal Audit Program - What auditors will check
2. Statement of Applicability - All controls implemented
3. Management Review - Quarterly review outputs

Document Information

• Version. 2.0
• Effective Date. 2025-01-13 (initial), 2026-02-16 (updated)
• Owner. ISMS Owner
• Review Frequency. Annually (before audit)
• Next Review. 2027-01-13
• Classification. Public