ISMS assurance records: keeping proof that your controls work

Assurance records are the proof that your controls actually operate: the record of this quarter's access review, last month's restore test, the annual awareness training, the review of your threat sources. Policies say what should happen. Assurance records show it did.

An auditor can't see your ISMS working. They can only see its records.

Why it matters

ISO/IEC 27001:2022 asks you to keep documented information as evidence throughout:

• Clause 7.5: keep the documented information the standard and your ISMS require, and control it.
• Clause 8.1: keep enough records to be confident your processes have been carried out as planned.
• Clause 9.1: keep evidence of monitoring and measurement results.

Many Annex A controls only make sense with a record behind them, for example 5.18 (access rights reviews), 6.3 (awareness training), 8.13 (backup testing) and 5.7 (threat intelligence).

What to record

For each recurring activity, a good assurance record captures:

• What was checked, and against what (the policy or control).
• When, and who did it.
• The result: pass, issues found, actions raised.
• The evidence: a report, screenshot, export or signed form.

Typical recurring assurance activities for a small organisation: quarterly access reviews, quarterly restore tests, annual awareness training, annual continuity exercise, regular threat intelligence reviews, supplier reviews, and policy reviews.

What an auditor looks for

• Records exist for the controls you've marked as implemented.
• They're on schedule. Quarterly means quarterly; gaps get noticed.
• They show a result, and any issues led to actions.
• They're traceable to the control or policy they support.

Common reasons it fails: controls marked implemented with no record; one-off evidence gathered just before the audit; or records with no date or owner.

Common mistakes, and how to keep it manageable

• Collecting evidence at the last minute. Record each activity when it happens; it takes seconds then and hours later.
• Saving files with no context. A screenshot without a date, a scope and a result proves little.
• Duplicating evidence. Store it once and link it to every control it supports.

How to do it in ClearIMS

1. Open Assurance register and pick the module for the activity, such as a continuity exercise or a training record.
2. Record what was checked, when, who did it and the result.
3. Attach the evidence and raise actions for anything that needs fixing. Actions get owners and due dates.
4. Let recurring tasks keep it on schedule. Recurring tasks bring activities such as access reviews, supplier reviews and restore tests round on time.

Related pages

• Evidence library: where files and documents are stored and linked.
• Readiness: which controls still lack evidence.
• Training and competence: a specialised assurance record.
• Threat intelligence: recording your threat source reviews.