How to Gather ISO 27001 Evidence for Infrastructure
Do not wait for the audit request list before figuring out where infrastructure evidence lives.
Start by mapping the controls to real workflows: certificate renewal, secret changes, SSH/RDP access, contractor support, deployment automation, and endpoint verification.
Evidence preparation flow
Preparation effort by evidence source
Control structure already exists.
Operational records are grouped.
High effort to normalize.
Painful and weak.
Build an evidence map
Create one row per control question. Example: production access approval, TLS renewal, secret rotation, privileged access review, incident follow-up.
Then map each row to the system of record. If the answer is Slack or a shell history file, fix the workflow.
Sample before the auditor samples
Pick a recent certificate renewal, a secret change, an SSH session, a contractor access grant, and a failed endpoint probe. Pull the evidence as if an auditor asked today.
This exposes gaps while you still have time to repair the control.
Keep the language honest
Do not claim CertLocker makes you ISO 27001 compliant. It does not. It can provide strong technical evidence for controls around TLS, secrets, tokens, access, and audit.
That distinction matters.
Preparation checklist
- ✓ Map controls to real infrastructure workflows.
- ✓ Identify the system of record for each evidence type.
- ✓ Collect five representative samples before the audit.
- ✓ Fix any workflow that depends on screenshots or memory.
- ✓ Keep exports tied to dates, owners, and review notes.
Related reading and workflows
Secrets management
Versioned secrets, scoped access, groups, and audit evidence.
Secrets and TLS automation
Why secrets and certificate workflows belong close together.
Secret version history
Browse, restore, and audit older secret values without guesswork.
Certificate lifecycle management
Inventory, renewal, delivery, ownership, and audit for TLS certificates.
Certificate delivery tokens
Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.
Endpoint probes
Check what production endpoints actually serve after renewal.
SSH access management
Short-lived SSH access, browser sessions, 2FA, groups, and audit.
Zero-trust SSH use case
A practical model for replacing long-lived PEM files.
Short-lived SSH access with 2FA
How CertLocker handles scoped server access and audit trails.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.