Guide 02 · Step 4 of 5

Implement and evidence

This is the step that takes the time. Everything before it was preparation for it.

Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.

Steps one to three are weeks of work for one person. This one is not, and by now you know why: the SoA has told you exactly how many controls you committed to, and each one needs to exist in practice and leave a trace.

Implemented is not the same as evidenced

An auditor does not accept that a control exists because the SoA says so. They ask to see it operating. The gap between "we do this" and "we can show we did this in March" is where most first audits fail.

• For each control, know the record. Access review → the signed review. Awareness training → completion records. Backup → the restore test log, not the backup job status.
• Date everything. An undated record is close to no record.
• Keep the boring evidence. Meeting minutes where risk was discussed, the ticket where an incident was handled, the email where a supplier was approved.

The controls people underestimate

Organisational controls (the 37) are where SMEs lose points, because they are about governance rather than technology: supplier relationships, asset ownership, segregation of duties, threat intelligence. These are not optional because they are administrative.