1. Understand the different assessment models
ISO/IEC 27001 specifies requirements for an information security management system. Certification involves independent assessment of that system within a defined scope. Risk assessment, treatment decisions and the Statement of Applicability help explain which controls are necessary and how they are addressed.
SOC 2 is an attestation examination against relevant Trust Services Criteria, not an ISO-style certification. A Type I report addresses control design at a specified date; Type II also addresses operating effectiveness over a specified period. Evidence planning must reflect the chosen scope, criteria and reporting period rather than treating the two approaches as interchangeable.
- Agree scope and evidence expectations with the relevant assessor early.
2. Make asset inventories and access reviews explainable
An asset inventory helps establish the population a control should cover. Useful fields include a stable identifier, owner, lifecycle state, source and last verification date. A list of devices alone does not demonstrate that all in-scope devices are included or appropriately managed.
Access-review evidence should show who reviewed which entitlements, the decision made and how required changes were followed up. Keep the review population and exclusions. Approval without a reviewer rationale or a link to remediation may leave important questions unanswered.
- Reconcile inventory samples against authoritative sources.
- Distinguish review completion from verified completion of corrective actions.
3. Connect suppliers and changes to responsibilities
Supplier information can support third-party risk management when it records the service provided, accountable owner, assessment date and unresolved issues. A contract or supplier name alone does not show that risks have been assessed or accepted by an authorised person.
Change records should connect the proposed change to approval, execution, validation and exceptions where relevant. Identify who owns the control and who performs each step. Responsibilities must remain clear when IT, HR, finance and external providers participate in the same process.
- Record review dates and follow-up ownership for supplier findings.
- Link change outcomes to validation evidence, not just a closed ticket.
4. Separate documented processes from proof of operation
A documented process describes expected behaviour. Operational records show what happened in particular instances. Reviewers may need both: a current procedure with an owner and approval history, plus samples demonstrating its application during the relevant period.
In a fictional access-review example, the procedure requires quarterly review, but the available records cover only the latest quarter. That gap should be documented and investigated. Recreating an earlier approval today would not prove that the review occurred at the required time.
- Keep policy versions distinguishable and associate samples with the applicable version.
- Record exceptions, their approval and the status of corrective work.
5. Use Lojycal as supporting infrastructure
Lojycal brings inventory, licences, procurement, finance, employee workflows, policy and evidence modules into a connected operational platform. Relevant records can support evidence preparation where the required data and workflows are available. Confirm coverage, permissions and configuration for your plan and workspace.
Append-only audit and signed evidence export mechanisms can support traceability and integrity checks. They do not make every record immutable or establish control effectiveness. Lojycal does not automatically certify an organisation or guarantee that an audit will succeed. Control selection, evidence interpretation and final review remain human responsibilities.
- Validate each proposed control-to-record mapping with the responsible control owner.
6. Prepare a scoped evidence plan
Build a request list that maps each control objective to a source, owner, frequency, period and review method. Prioritise gaps in coverage or verification over presentation polish. Agree sampling and format with the assessor rather than assuming a dashboard will satisfy every request.
For evaluation, choose one inventory control and one access-review control. Follow their records from source through review to export. Check whether another person can reproduce the reasoning without relying on the original operator's memory.
- Test missing records, overdue reviews and unresolved exceptions.
- Use /contact to discuss evidence requirements without assuming a compliance outcome.