Guide 01 · Step 4 of 5
Operate with evidence
Steps 1 to 3 produce a design. This step produces proof, and it is where the programme stops being a project and becomes a function. It is also where most small companies stop.
Independent guidance from Synergy. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. Always work from the published text of the standard.
Four things have to run continuously:
Operations log. What is running, who has access, and when it changed. One line per change.
Test register. Evals, red teaming, dates, results, and what you changed as a result. A test with no resulting action is a box ticked.
Incident procedure. Detection, escalation, notification, and a written review. Short is fine. Exercised is not optional.
Evidence register. One row per control, and this is the artefact that matters:
| Control | Designed | Operating | Evidence | Date | Checker |
|---|---|---|---|---|---|
| Human review of customer replies | Yes | No | 0 rejections recorded in 90 days | 2026-09-30 | M. Dupont |
| Agent permissions reviewed | Yes | Yes | Review pack, Q3 | 2026-09-30 | K. Janssens |
| Incident procedure exercised | Yes | No | No exercise since adoption | 2026-09-30 | M. Dupont |