ISO 27001 evidence automation: exported in February, asked for in March
The auditor asks for evidence that access reviews happened quarterly. It is March. The reviews did happen, in the sense that somebody looked at the access list and thought about it, and there is no record of any of them.
So the next two days go on reconstructing what can be reconstructed and being honest about the rest. This is the most avoidable category of audit finding there is, because the evidence existed at the time and nobody captured it.
What iso 27001 evidence automation can and cannot do
Being clear about this first, because the pitch for compliance tooling frequently is not.
A script can produce the artefact. A dated export of who has which role, of MFA registration status, of device compliance, of backup job outcomes. These are queries against systems that already hold the answer, and running them on a schedule and keeping the output is genuinely most of the evidence burden.
A script cannot make the decision. An access review is not a list of who has access. It is somebody looking at that list and deciding each entry should continue, with their name against the decision. The export is the input to the review, not the review.
That distinction is where automated compliance platforms are oversold and where they are genuinely useful. They will collect the evidence. They will not do the thinking, and an auditor asking "who reviewed this and what did they conclude" is asking about the thinking.
So the target is not a fully automated evidence pack. It is that every recurring artefact exists, dated, without anybody remembering to produce it, so the human effort goes entirely on the decisions.
What is worth scheduling
Ranked by how much manual effort it removes.
Access lists. Azure role assignments, Entra role assignments and eligible roles, group memberships for anything privileged, guest accounts with what they can reach. Monthly. This is the highest-value export because the underlying data changes constantly and reconstructing a past state is impossible.
MFA and authentication method coverage. Per user, monthly. Answers a question that appears in almost every customer questionnaire as well as in the audit.
Device compliance status. Per device, with the policy applied. Monthly. Pairs with Intune configuration exports, which cover the configuration side while this covers the outcome side.
Backup and restore outcomes. Job status is easy. Restore tests are the evidence that matters and cannot be automated into existence, only recorded.
Patch and vulnerability status. A point-in-time export monthly is worth more than a live dashboard, because the auditor's question is about a period rather than about today.
Certificate and credential expiry. Monthly, from the credential note. Doubles as operational monitoring.
Where to put it
Three properties matter, and the ordering is deliberate.
It has to be dated by the system rather than by the filename. A file called
access-review-q1.xlsx proves nothing about when it was produced. Storage with
immutable timestamps, or a repository where the commit carries the date, does.
It has to survive the person. Not a folder on your laptop, and not a personal OneDrive. A document library or a storage account with a retention policy, owned by the company.
It has to be retained longer than the audit cycle. Surveillance audits sample the period since the last one, so anything with a retention shorter than about eighteen months will have aged out of the window you get asked about.
A storage account with a lifecycle policy and immutability, or a repository with one commit per export, both work. The repository option has a side benefit: a diff between months shows what changed, which turns an evidence archive into a drift report for free.
The naming that saves you two days
Name exports so a human can find one under time pressure. Control reference, artefact, date:
A-5-18_azure-role-assignments_2026-05-01.csv
A-5-18_entra-eligible-roles_2026-05-01.csv
A-8-5_mfa-registration_2026-05-01.csv
A-8-8_vulnerability-status_2026-05-01.csv
A-8-13_backup-job-outcomes_2026-05-01.csv
The control reference in the filename is what turns "we have the evidence somewhere" into handing over a folder. When an auditor asks about a specific control, you filter by prefix. Without it you are opening files to find out what they are, in a meeting, which is where the two days go.
Retention, and the thing people get backwards
An evidence archive has a retention requirement that runs in the opposite direction to most data policies, and it catches people out.
Ordinary data retention is about deleting things you no longer need, and the instinct from GDPR work is to minimise. The ICO's guidance on storage limitation is about personal data held without a continuing purpose, and an evidence archive does have a continuing purpose, which is demonstrating that controls operated.
The tension is real where the evidence contains personal data, and access lists and MFA status both do. Two things resolve it in practice. Export the minimum identifying detail needed for the evidence to mean anything, which is usually a user principal name rather than a full profile. And state the retention period and its purpose in your own retention schedule, so holding it is a documented decision rather than an oversight.
What does not work is deciding at audit time. Either you have eighteen months of dated exports or you do not, and a policy that quietly deleted them at twelve months is a worse conversation than not having automated it at all, because the gap is visible and dated.
The part that still needs a person
For each export, somebody has to look and record what they concluded. That record is short and it is the thing being audited:
Access review, Azure role assignments, 2026-05-01
Reviewed by: [name], [date]
Assignments reviewed: 34
Removed: 2 (orphaned, deleted identities)
Retained with justification: 1 (external contractor, integration support,
reviewed again 2026-08-01)
No other changes required.
Four lines and a date. That is what distinguishes a review from an export, and it is what was missing in the opening paragraph. Automating the export makes producing this take five minutes instead of an afternoon, which is the actual reason the reviews start happening reliably.
Where this sits
This is the operational half of what the book covers, and the evidence question is the one that separates companies that pass Stage 2 from companies that have a good ISMS on paper. The controls are usually fine. Proving they operated over a period is the work.
Scheduling it properly means it has to fail loudly, per the exit code note. An evidence job that silently stops producing exports leaves a gap in exactly the period you will be asked about, and you will not discover it until the audit.