ISO 27001 evidence
Use Sparta to organize scoped information-security control evidence while retaining the management-system and assessment work outside the checklist.
Establish scope
Select ISO 27001 in organization settings and define the systems, locations and period covered by your information security management system.
Use the mapped controls to assign owners, select evidence sources and retain manual records. Shared evidence can support more than one mapped framework, but the mapping does not replace a scope or applicability decision.
Evidence to retain
- Approved policies and their review history.
- Access approvals, reviews and removals.
- Risk decisions, remediation and accepted exceptions.
- Operating evidence for the selected controls.
- Management-system reviews and assessment records required by your engagement.
Prepare for review
Review gaps before building the package. A complete catalog or a passing checklist percentage does not establish conformity or certification. Agree the applicable requirements and evidence expectations with the organization and assessor.
Start with the control checklist.