Preparing your audit in 5 steps, without a week of screenshots

The auditor is coming in two weeks. You receive a list of forty pieces of evidence: access lists, patch overviews, backup reports, incident logs. You know that everything exists somewhere. In the coming days, you will mainly be searching.

It can be done differently. Not with a miracle cure, but with a habit: collecting evidence at the moment it comes into being, instead of afterwards. Below are five steps to get there.

Why the usual approach takes so much time

Collecting often only starts when the auditor sends their list. The team takes screenshots, runs exports and searches for old emails. By the time everything is in, part of it is already out of date. And at the next audit, it starts again. The real problem is not the auditor. It is that the evidence only comes into being at the moment someone asks for it.

Step 1: log automatically, in one place

Make sure that security events are recorded automatically: sign-ins, changes to rights, administrator actions and configuration changes. Bring them together in one place, so that you do not have to search per system. Also decide how long you keep logs. An audit often covers a whole year, so a retention period of a month does not help you.

Step 2: let evidence come in by itself

For each piece of evidence, check whether it can be automated. Think of a monthly export of users and rights, a backup report that goes to a fixed folder or a script that writes the patch status to a file. A GRC tool can help. A well-organised folder with fixed file names also works. Start with the five pieces of evidence that come back at every audit and automate those first.

Step 3: link evidence to controls

Make a table: which piece of evidence belongs to which control in ISO 27001, the BIO or NIS2? Much evidence counts for several frameworks at once. A review of rights, for example, can be used for all three.

Keep the table simple. Per row: the piece of evidence, the controls it counts for, the owner, how often it is needed and where it is kept. You rarely need more columns.

Step 4: set up an evidence calendar

Some pieces of evidence are periodic. Put them in a calendar, with an owner and a fixed place to store the result. A simple start:

• Every month: a review of the rights of administrator accounts and a test with a restored backup.
• Every quarter: a review of suppliers and their sub-processors.
• Every year: a tabletop exercise for incidents, a revision of the security policy and an awareness training.

Put the calendar in a place where your team sees it, not only in your own diary.

Step 5: do a trial audit

Ask a colleague who does not know the system to request ten random pieces of evidence. Can you deliver them within an hour? What does not work goes on the list. That way, you find the gaps before the auditor finds them. Do it a month before the real audit, so that you have time to close them.

Who does what?

Collecting evidence is not a job for one person. Give each piece of evidence an owner at the place where it comes into being: system management for rights and patches, HR for joiners and leavers, the service desk for incidents. You keep the calendar up to date and check whether everything comes in on time.

What it delivers

You no longer search for the evidence, because it is already there. And you see where you stand all year round, including in the week before the audit.

On our compliance page you can read which technical measures Noveu applies.