Would the records be there if the auditor asked tomorrow?

The scope of the system to be audited is written down: entities, locations, services, systems, people.

Every control or policy has a named owner, a version and a review date.

Leadership has reviewed the security programme in a minuted meeting in the last year.

A risk assessment exists, with a documented method, a register and treatment decisions.

There is an inventory of information assets and systems with owners and a classification.

User access to key systems is reviewed on a schedule, and the reviews are recorded.

Leavers lose access on their last day, and there is a ticket or log that proves it for each one.

Multi-factor authentication is enforced for email, cloud consoles and remote access.

Changes to production are approved before deployment, and the approval trail can be exported for a period.

Vulnerability scans run on a schedule and findings are tracked to closure.

There is an incident procedure with reporting deadlines, and it has been exercised or used in the last year.

Backups exist, and a restore has been tested and recorded in the last year.

There is a business continuity plan with recovery objectives, walked through at least once.

Critical suppliers are listed, assessed for security, and bound by contract terms.

Where personal data is processed, there are records of processing, processor agreements and a way to handle rights requests.

Data has a retention schedule and deletion actually happens.

Everyone completes security awareness training, and completion is recorded.

New joiners are screened proportionately and sign confidentiality terms.

An internal audit by someone independent of the area has been done in the last year, with findings tracked.

For every periodic control there is a folder or system where the artefacts accumulate without being asked for.