Information security

ISO/IEC 27001: ISMS requirements, 93 Annex A controls and a three-year certification cycle

Statement of Applicability, internal audits, management review and annual surveillance audits: what the standard requires and what evidence is needed.

Let's talk Starting assessment

ISO/IEC 27001 sets the requirements for an information security management system (ISMS). Certification is issued by an accredited body and maintained through annual surveillance audits and recertification every three years. Evidence therefore has to be produced and retained throughout the cycle, not only for the initial audit.

Who it applies to

Any organisation, of any size and sector, on a voluntary basis.
Often required by customers, tenders and contracts, especially for IT and cloud service providers.
A useful reference to structure NIS2 and DORA measures.

What it requires

01
Context and scope
Definition of the scope, interested parties and security objectives.
02
Risk assessment and treatment
A documented method, a treatment plan and a Statement of Applicability.
03
Annex A controls
93 controls in four themes: organisational, people, physical and technological.
04
Leadership and resources
Top management commitment, roles, competence, awareness and communication.
05
Performance evaluation
Monitoring, internal audits and management review at planned intervals.
06
Improvement
Handling of nonconformities, corrective actions and continual improvement.

EVIDEVO

How EVIDEVO manages controls and evidence for ISO/IEC 27001

Annex A linked to NIS2 and DORA

In Controls and compliance, the 93 Annex A controls are linked to the NIS2 and DORA requirements that use the same evidence.

Statement of Applicability from control data

Applicability, justification and status are recorded on each control; the Statement is exported from this data.

Internal audits and reviews

In Audits and reviews, findings, corrective actions and due dates are linked to controls, with the history of decisions.

Dated evidence by period

Evidence is dated and collected during the year; for the surveillance audit it is extracted by control and by period.

ComplianceControls

Search⌘K IT

ControlsExport

All 48Mine 12To fix 5Evidence to refresh 6

Quarterly access rights reviewCTL-IAM-001 · NIS2 21.2(i) · ISO A.5.18 Compliant
Multi-factor authentication for privileged accessCTL-IAM-004 · NIS2 21.2(j) · ISO A.8.5 Non-compliant
Monthly vulnerability scanningCTL-VUL-002 · NIS2 21.2(e) · ISO A.8.8 At risk
Early warning to the CSIRT within 24 hoursCTL-INC-003 · NIS2 art. 23 · DORA art. 19 Compliant
Annual business continuity plan testCTL-BCM-002 · NIS2 21.2(c) · ISO A.5.30 In review
Assessment of critical ICT providersCTL-SUP-005 · NIS2 21.2(d) · DORA art. 28 At risk

CTL-IAM-001Compliant

Quarterly access rights review

OwnerITIT lead Next review31 dic 2026

Evidence

Q3 access review minutesUploaded 2 Oct · valid until 31 DecUp to date
List of disabled accountsRefreshed daily at 06:00Up to date

Requirements covered

NIS2 21.2(i)ISO A.5.18DORA art. 9

History

2 OctThe IT lead uploaded the Q3 minutes
1 OctThe compliance lead approved the review
3 JulQ2 review closed, no exceptions

Data for illustrative purposes only, not real

What can be exported

Statement of Applicability
Evidence by control and by period
Log of nonconformities and corrective actions

Capabilities for ISO/IEC 27001

How to determine whether ISO/IEC 27001 applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Guides on ISO/IEC 27001

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk