Understanding ISO 27001 Evidence for Infrastructure
ISO 27001 evidence is proof that a control exists and has operated. For infrastructure teams, that proof should come from production workflows, not last-minute screenshot hunts.
If the control says production access is approved and logged, the evidence is the access request, scope, expiry, 2FA event, session record, and review.
Simple evidence model
Manual vs workflow-generated evidence
Fast once, poor repeatability.
Better detail, still needs interpretation.
Action, owner, and proof stay together.
Evidence is not the same as a policy
A policy says what should happen. Evidence shows what did happen. Infrastructure teams get caught when the policy is neat and the production workflow is messy.
The goal is not paperwork. It is a trustworthy trail.
Examples that matter
For TLS: renewal records, delivery tokens, reload state, endpoint probe results, and ownership.
For access: SSH/RDP grants, 2FA, scope, expiry, and audit trail. For secrets: read logs, change logs, version history, and rotation evidence.
CertLocker as an evidence source
CertLocker creates operational evidence around certificates, secrets, tokens, SSH/RDP access, MCP agent access, and endpoint checks. That evidence can support the ISO process without turning engineers into document clerks.
Good evidence should answer
- ✓ Who did it?
- ✓ What system, secret, certificate, or host was touched?
- ✓ Why was access granted?
- ✓ When did it start and expire?
- ✓ What proof shows the intended result happened?
Related reading and workflows
Help with onboarding
Bring your existing inventory to a hosted walkthrough with the CertLocker engineers.
CertLocker for DevOps teams
The broader trust-control workflow for platform and infrastructure teams.
Compare CertLocker with scripts
Where spreadsheets, cron jobs, and shared files stop being enough.
Certificate lifecycle management
Inventory, renewal, delivery, ownership, and audit for TLS certificates.
Certificate delivery tokens
Scoped certificate access for HAProxy, IIS, Nginx, scripts, and automation.
Endpoint probes
Check what production endpoints actually serve after renewal.
SSH access management
Short-lived SSH access, browser sessions, 2FA, groups, and audit.
Zero-trust SSH use case
A practical model for replacing long-lived PEM files.
Short-lived SSH access with 2FA
How CertLocker handles scoped server access and audit trails.
Try the workflow against real infrastructure
Use the hosted evaluation at trust.certlocker.io for a walkthrough, or run a one-month onsite evaluation against your own certificates, hosts, secrets, and access paths.