Evidence: articles and guides.
Every CloudSoul article on Evidence, newest first.
ISO 27001 surveillance audit: what happens in years two and three, how long it takes and what the auditor samples
An ISO 27001 surveillance audit happens at least once a calendar year, the first within 12 months of certification, and takes about a third of the initial audit time. What it must cover, what the auditor samples, and what happens when it goes wrong.
How to answer a customer security questionnaire: CAIQ, SIG, VSA and the three questions behind them
Answer the three questions behind every row once, from a library keyed to your controls. A CAIQ of around 260 questions then takes 2 to 4 days, not 2 to 3 weeks. The formats, why inconsistent answers lose deals, what ISO 27001 pre-answers and what to ask back.
ISO 27001 audit evidence: what auditors ask for, and how to collect it without the pre-audit scramble
ISO 27001 auditors sample dated records from across the audited period, not a snapshot taken the month before. What the standard requires as documented information, typical evidence per control area, how fast it goes stale, and how to collect it as the work happens.