Evidence on request

Overview

Noveu provides technical and organisational evidence on request. Get in touch via compliance@noveu.eu.

Use the categories below to set up your own evidence calendar and to collect the documents for your audit. Record per piece of evidence who maintains it and how often you check it.

Evidence categories

1. Governance & Organisation

Evidence	Description	Frequency
Security Policy	Current security policy	Every year
ISMS Scope	Scope of information security	Every year
Risk Register	Identified risks and mitigations	Quarterly
Management Review	Minutes of the management review	Every six months
Roles & Responsibilities	RACI matrix security	Every year

2. Access management

Evidence	Description	Frequency
User Access List	All users and rights	On demand
Admin Account List	Privileged accounts	Monthly
Access Reviews	Periodic rights reviews	Quarterly
MFA Coverage	Percentage MFA-enabled	Monthly
Password Policy	Password requirements	Every year
Session Logs	Login/logout events	Daily

Example Export (Users):

UserId,Email,Department,Role,MFAEnabled,LastLogin,Created
u001,jan@example.com,IT,Admin,true,2026-01-15,2025-06-01
u002,lisa@example.com,Finance,User,true,2026-01-14,2025-07-15

3. Infrastructure & Network

Evidence	Description	Frequency
Network Diagram	Current architecture	Every year
Firewall Rules	Rule set per zone	Quarterly
Hardening Status	Compliance with baselines	Monthly
Patch Status	Vulnerability and patch levels	Weekly
Encryption Status	Encryption configuration	Monthly

Example Export (Patch Status):

{
  "reportDate": "2026-01-15",
  "systems": [
    {
      "hostname": "app-server-01",
      "os": "Ubuntu 22.04",
      "patchLevel": "current",
      "criticalVulns": 0,
      "highVulns": 2,
      "lastScan": "2026-01-14"
    }
  ],
  "summary": {
    "totalSystems": 50,
    "fullyCurrent": 48,
    "pendingPatches": 2
  }
}

4. Operations & Monitoring

Evidence	Description	Frequency
Uptime Reports	Availability per service	Monthly
Incident Log	All security incidents	On demand
Change Log	All changes	On demand
Backup Reports	Backup success/failure	Weekly
DR Test Results	Disaster recovery tests	Every six months

5. Vendor & Supply Chain

Evidence	Description	Frequency
Subprocessor List	All suppliers	Quarterly
Vendor Assessments	Security assessments	Every year
Contracts	DPAs and security addenda	On demand

6. Awareness & Training

Evidence	Description	Frequency
Training Records	Who was trained in what, and when	On demand
Phishing Results	Results of phishing tests	Quarterly
Policy Acknowledgements	Signed policies	Every year

Framework Mappings

NIS2

NIS2 Article	Evidence category	Documents
Art. 21(a): Risk analysis	Governance	Risk Register
Art. 21(b): Incident management	Operations	Incident Log, Runbooks
Art. 21(c): Continuity	Operations	DR Test Results, Backup Reports
Art. 21(d): Supply chain	Vendor	Subprocessor List, Assessments
Art. 21(e): Network security	Infrastructure	Firewall Rules, Hardening
Art. 21(f): Access management	Access management	Access Reviews, MFA Coverage
Art. 21(g): Cryptography	Infrastructure	Encryption Status

BIO

BIO Control	Evidence category	Documents
9.x: Access	Access management	User Lists, Access Reviews
11.x: Physical	Infrastructure	DC Audit Reports
12.x: Operations	Operations	Change Log, Incident Log
14.x: Development	n/a	SDLC Documentation
16.x: Incidents	Operations	Incident Log, Runbooks
18.x: Compliance	Governance	Audit Reports

ISO 27001

ISO Clause	Evidence category	Documents
A.5: Policies	Governance	Security Policy, ISMS Scope
A.6: Organisation	Governance	Roles & Responsibilities
A.7: HR	Training	Training Records
A.8: Asset Mgmt	Infrastructure	Asset Register
A.9: Access	Access management	All access documentation
A.12: Operations	Operations	All operations logs
A.16: Incident	Operations	Incident Log
A.18: Compliance	Governance	Audit Reports

Contact

Audit Requests: compliance@noveu.eu