ISO 27001 · Evidence Trail
From risk register to verifiable auditor export — without evidence chaos.
Certification is the easy part — proving compliance over time is the hard part.
"I can claim it — but I cannot prove it. The audit can come any time." This is how CISOs describe their situation under audit pressure — and ISO 27001 poses the same problem between surveillance audits: A certificate proves a state at a given point in time, not continuous conformity per Clause 9 and 10 in the months between. Whoever waits to collect evidence until the next audit has, in effect, none.
Then there is sheer scope: The Statement of Applicability per Annex A covers 93 controls, each with a traceable justification for why it applies or not — and proof that it is actually implemented. Without structured storage, that evidence scatters across folders, tickets and emails until no one knows which version is current.
ISO 27001 already covers roughly 70% of NIS2 requirements — an ISO-first approach thus builds the bridge to NIS2 automatically. And without ongoing findings and CAPA tracking, recertification itself becomes an Excel exercise: who closed which deviation when, and what proof can you show the auditor?
Four building blocks for airtight ISO 27001 evidence.
Risk Register (ISO 27005) & 5×5 Heatmap
Risks are captured, rated and visualized in a 5×5 heatmap per ISO 27005 — instead of gathering dust in a spreadsheet no one keeps current. The rating flows directly into the Statement of Applicability.
Sealed Snapshots (WORM)
The state of risk register, SoA and controls is cryptographically sealed and immutable at every relevant point in time — you can prove to the auditor exactly which state existed when.
Findings & CAPA, Attestation Lifecycle
Deviations from internal audits or control reviews are captured as findings, linked to corrective action plans and tracked to attestation by those responsible — instead of scattering across disconnected action lists.
Auditor Export with Offline Verifier
For recertification audit, a complete export package is generated whose seals the auditor can verify with a standalone offline verifier — with no need to access your system or trust you.
More on ISO 27001 & the engine behind it.
Certification cycle, Annex A controls and primary sources in detail.
Regulation details →How control assessment works and how it covers ISO 27001, NIS2, DORA and the AI Act at once.
Feature in detail →Your first sealed ISO 27001 evidence — today.
In 30 minutes we show you what ReportAct delivers for this use case – no obligation.