One page per clause
The duty in our words, the evidence a board or an auditor asks for, the common gaps and what to do before publication.
Open the registerWhat governance evidence does a board or an auditor ask for?
The role map with the governing body and top management, the six objectives with owners and evidence, the records of the four processes, the approved risk appetite with thresholds, the board reporting cadence and written response, and the charter of each management system with its scope and certification scope. Each clause page on this site lists the specific artefacts.
Last updated: . Written from the published edition and the ISO record. Not legal advice; does not certify.
Start with the roles and the type
The role map shows whether the governing body and top management are distinct and named. The Annex B type shows whether the management system organization is the whole entity, part of a larger one or shared. Without those two, the rest of the evidence has no owner.
Then the objectives and the appetite
Each of the six objectives needs an owner and an artefact. The appetite needs thresholds and an approval. A board paper that cites neither is reporting activity, not governance.
Then the process records
Evaluate needs a written response to the performance report. Direct needs the strategy, appetite and resource decisions. Monitor needs the effectiveness report and the priorities sent back. Communicate needs the statement of status, the incident explanation and the communication plan.
What a board does not accept
A policy on its own, a certificate, or a vendor attestation. The governance is the organization own, and the evidence is the record behind it.
Related clauses
- 6.1 Overview: governance and management of information security
- 7.2.2 Objective 2: Make decisions using a risk-based approach
- 7.3.4 Monitor
- 8.1 Organization and ISMS
Questions
How many evidence items are there?
The register lists 110 evidence lines across 28 clause and annex pages. The kit consolidates them into one working file so a team can assign an owner to each.
Do I need all of it for a small entity?
The guidance applies in full, but the depth can beproportionate. Start with the role map and the objectives, then work the process cycle.
Can I use the kit as the evidence?
No. The kit is the register and the plan. The evidence is your record: your roles, your risks, your board minutes, your reports.
Run the free check / Open the register / The kit and the watch
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official rule behind it, so you can check any line yourself. The register holds 28 records, 110 evidence lines and 84 common failure lines. The dates come from the ISO record. The substance comes from the published 2020 edition, which is the baseline that edition 3 replaces.
25 CLAUSES
3 ANNEXES
Guidance, clearly labelled
Annexes A to C are informative. Each page says so, because a finding cannot rest on guidance alone.
Open the annexesONE STAGE RECORD
No invented date
Stage 50.60 is recorded on 12 August 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe edition 3 text is not public and is not reproduced. Each record cites the published clause it comes from. Where the public record is silent, the page says so.