ISO 27001: how to automate evidence collection

You can automate the collection of ISO 27001 evidence, such as access lists, configuration snapshots and scan results, by pulling them on a schedule with timestamps. You cannot automate judgment. Risk decisions, management review and internal audit conclusions still need named people. Automation supplies the records they work from.

What does an auditor want to see?

ISO/IEC 27001:2022 asks you to run an information security management system (ISMS). Coverage of the standard we reviewed describes clause 6.1 on risk assessment and treatment, clause 9.3 on management review, and clauses 10.1 and 10.2 on continual improvement. Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34).

Certification, where a company chooses it, involves a Stage 1 and Stage 2 audit by an accredited body. This post explains the standard. Software cannot certify you, and no tool, ours included, holds a certificate on your behalf.

Which evidence is worth automating?

Think in two groups.

Records a system already produces. These suit scheduled collection:

• User and role lists from your identity provider, exported monthly
• Configuration state of cloud accounts and endpoints
• Vulnerability and dependency scan results, with dates
• Backup job outcomes and restore tests
• Training completion records
• Change records from your ticketing and code review systems

Records that need a human act.

• The risk register and the reasons for each treatment choice
• The Statement of Applicability, which says which controls apply and why
• Minutes of management review
• Internal audit reports and the follow-up on their findings

A common mistake is to automate the first list and call the job done. An auditor will still ask who looked at the output and what they decided.

What makes automated evidence credible?

Three properties.

1. Timestamp and source. Each item says when it was pulled and from which system.
2. Integrity. The record is stored so that it cannot be quietly edited later, for example with a hash and an append-only location.
3. Mapping. Each item is linked to the control it supports, so an auditor can sample by control and not by folder.

A screenshot taken the night before an audit meets none of these. A scheduled export with a hash meets all three.

How often should evidence be collected?

Match the cadence to how fast the thing changes. Access lists and cloud configuration can drift in a day, so a weekly or monthly pull is typical. Training records change a few times a year. A policy approval changes once a year. Collecting everything daily creates noise that nobody reviews, and collecting everything yearly leaves gaps an auditor can find by sampling a random date.

Pick a cadence per evidence item, write it in the control record, and keep to it. A missed pull is itself a finding, so make failures visible: an alert when a scheduled export does not run is worth more than a pretty dashboard.

Where does Safeguard fit?

Safeguard offers compliance automation, covering frameworks, controls and evidence, and runs scans that produce dated machine-readable results. Used well, that handles the technological controls that depend on software inventory and vulnerability data. It does not write your risk assessment, and it does not replace your certification body.

What to do

1. Export the list of Annex A controls you consider in scope, and note the evidence each one needs.
2. Mark each evidence item as system-produced or human-produced.
3. Automate the system-produced list first, starting with identity, cloud configuration and scan results.
4. Store each pull with a timestamp and hash in a location with restricted write access.
5. Assign an owner and a review date to every human-produced item.
6. Run an internal audit that samples by control before the certification body does.

Quick check

Sources

• ISMS.online: ISO 27001 overview

Last reviewed: 18 October 2026.