October is Cybersecurity Awareness Month, and the commentary arriving with it is converging on one theme. In its October 1 awareness-month statement, GRC vendor IntelliGRC argues that the hard part of compliance is proving you stay compliant, on paper and on demand. The point is made for small businesses, but it applies just as well to a global enterprise with a multi-site ISO/IEC 27001 certificate.
The context is sobering. The same statement cites the FBI’s Internet Crime Complaint Center reporting more than one million complaints in 2025 with roughly $21 billion in losses, and Verizon’s 2026 Data Breach Investigations Report finding that 31% of breaches now start with vulnerability exploitation and 48% involve a third party (figures as reported by the vendor; please check the original reports). In that environment, a certificate on the wall answers only a narrow question. This article explains what has changed in ISO 27001, why documents are no longer enough, and a six-step plan to prove your controls run.
Crest.Digital’s platform gives risk, security and procurement teams continuous visibility of vendor posture, open remediation and control health, so audit prep stops being a scramble.
Explore the PlatformWhy the Awareness Month Message Matters for ISO 27001
ISO/IEC 27001 is the international standard for an information security management system (ISMS). A certificate says an accredited body examined your ISMS, within a defined scope, at a point in time, and found it conforming. It does not say every control worked every day since. That distinction is easy to lose when the certificate is used in a sales deck, a vendor questionnaire or a board pack.
Enterprise buyers know this, which is why they increasingly ask suppliers for more than a certificate. If you sit on the buying side, we explain in why ISO 42001 certified does not mean AI-governed how scope and exclusions change what a certificate is worth; the same checks apply to ISO 27001. If you sit on the supplier side, expect the questions to get sharper.
What Has Actually Changed in ISO 27001
There is no ISO 27001:2026. Organisations operate under ISO/IEC 27001:2022, with a 2024 amendment on climate. Several practical changes are nevertheless now fully in force.
The Facts Every Compliance Lead Should Have to Hand
- The transition window has closed. The 36-month transition from the 2013 edition ended on October 31, 2025, so certificates to the 2013 edition are no longer valid.
- Annex A was restructured. The 2022 edition reduced the controls from 114 to 93, grouped as organisational, people, physical and technological, and added controls on areas such as threat intelligence, cloud services and secure coding.
- Climate relevance must be decided. Amendment 1:2024 asks organisations to determine whether climate change is relevant to their ISMS and to record the decision either way.
- Auditors look for operation over time. Practitioner guidance reports that certification bodies increasingly expect evidence across several months showing controls were applied, not just documented.
The last point comes from industry commentary rather than the standard itself, so treat it as direction of travel and confirm expectations with your certification body. But it matches what we see in client audits: a written access-review procedure earns far less credit than three consecutive quarters of completed, signed reviews.
The Gap Between a Documented Control and an Operating Control
Most ISMS programmes are strong on documents: policies, a statement of applicability, a risk register. They are weaker on the evidence trail that shows each control working. We see the same three gaps repeatedly.
Evidence is gathered at audit time. Screenshots, exports and emails are collected in the weeks before the audit by people who would rather be doing something else. Anything that failed in March is invisible by October. Our piece on continuous evidence, not just continuous monitoring explains why the evidence itself must be captured as controls run.
Ownership is vague. A control such as leaver access removal spans HR, IT and the business. If nobody owns the exception list, nobody closes it. We cover the access side in vendor access recertification as a continuous control.
Suppliers are treated as out of scope. With 48% of breaches reported as involving a third party, an ISMS that stops at the company boundary leaves a large share of risk untested. Supplier assurance belongs inside the ISMS, with evidence refreshed when supplier risk changes. Our guide to the CISO’s approach to vendor cyber risk shows how.
There is a wider lesson here that internal audit teams will recognise. A policy only becomes an internal control when someone tests it, a point we make in an AI policy isn’t an internal control until someone tests it. ISO 27001 is no different.
A Six-Step Plan to Prove Your Controls Run
You do not need a new standard to close the gap. You need a repeatable way to turn each control into a stream of dated evidence. This sequence works for in-house teams and for suppliers preparing for customer audits.
Map Each Control to a Named Owner and a Test
For every Annex A control in your statement of applicability, record who owns it, how often it operates, and what test shows it worked. Controls without a test are intentions.
Define the Evidence Each Test Produces
Specify the artefact, its source system and its timestamp. A system-generated log beats a screenshot, and a signed review beats an email saying it was done.
Connect the Source Systems
Link identity, endpoint, cloud, ticketing and HR systems so evidence flows automatically. Start with the controls auditors ask about most: access, change, vulnerability and backup.
Monitor for Drift and Raise Exceptions Early
Set thresholds, such as overdue reviews or unpatched critical systems, and route breaches to owners with deadlines. An exception caught in week two is a finding avoided in month ten.
Extend the Same Discipline to Suppliers
Tier suppliers by criticality, collect their certificates with scope and expiry, and refresh assurance when their risk profile changes rather than annually.
Report to Leadership on Operation, Not Certification
Give the board and audit committee a short dashboard: controls tested this quarter, exceptions open and ageing, supplier changes. Certification becomes one data point, not the whole story.
Internal audit can then rely on this evidence rather than rebuild it, drawing on the Institute of Internal Auditors standards for testing and the ISACA guidance on control monitoring. For a view of the difference between collecting evidence and reaching a conclusion, see why evidence is not assurance.
Crest.Digital’s Agentic GRC workflows collect evidence, track remediation and prepare audit-ready packs continuously, with human approval and a full activity record. See the industries we cover.
Where Agentic AI Fits: Evidence on Tap, Judgement With People
The reason evidence collection stays manual is that it spans many systems and many people. That is precisely the work agentic AI is suited to. Agents can pull access lists, patch status and review records from connected systems, match them to the control they support, flag gaps and chase owners for fixes, then assemble the audit trail.
What agents should not do is decide that a control is effective. That judgement stays with accountable owners and internal audit, with every agent action logged so it can itself be audited, a theme we develop in why AI agents need audit trails. The result is the combination auditors are asking for: evidence that is continuous, traceable and reviewed by people.
Your Turn: How Do You Prove It Today?
- Audit-time proof: Evidence is collected in the weeks before surveillance audits.
- Periodic proof: Key controls are tested quarterly with owners and sign-off.
- Continuous proof: Evidence, exceptions and supplier changes flow automatically and reach leadership monthly.
Which describes your ISMS? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Cyber risk in vendor relationships is not uniformly distributed. The vendors that represent the highest exposure are rarely those with the longest questionnaire responses — they are the ones with privileged access to production systems, those processing unstructured data at scale, and those operating in jurisdictions with limited breach notification requirements. Risk tiering that reflects actual access and data flows is more predictive than vendor size or certification status alone.
Frequently Asked Questions
No. The current edition is ISO/IEC 27001:2022, which reduced Annex A from 114 to 93 controls and grouped them into organisational, people, physical and technological themes. A 2024 amendment added a requirement to consider whether climate change is relevant to the ISMS. The transition from the 2013 edition ended on October 31, 2025, so certificates to the older edition are no longer valid. Always confirm the latest position on the ISO website and with your certification body.
Auditors expect proof that each applicable control is implemented and operating, not only described. Typical evidence includes dated access review records, change and incident tickets, vulnerability scan and patch reports, supplier assessments, management review minutes and internal audit reports. Practitioner guidance suggests evidence spanning several months is increasingly expected. System-generated records with timestamps and named approvers carry more weight than screenshots or retrospective summaries.
Not by itself. A certificate shows that an accredited body found the supplier’s ISMS conforming within a stated scope at a point in time. Buyers should check the scope statement, the statement of applicability and any exclusions, confirm the certificate is current, and ask whether the services they actually use are covered. Between audits, continuous monitoring of the supplier’s security posture and incidents helps close the gap a certificate cannot.
Continuous controls monitoring tests controls on a regular schedule using data from source systems, and records the result as dated evidence. For ISO 27001 this means access reviews, patching, backups and change approvals are checked as they happen, exceptions are raised to owners quickly, and the audit file builds itself. Internal audit can then test a sample of the monitored evidence rather than rebuild it, shortening audits and reducing last-minute remediation.
AI agents can gather evidence across identity, cloud, ticketing and HR systems, map it to controls, flag missing or stale items and track remediation to closure, producing an audit-ready trail. Control owners and internal audit still review the results and decide whether controls are effective. Every agent action should be logged and attributable so the automation is itself auditable, which keeps the approach consistent with a human-in-the-loop governance model.