Measures and evidence: what you record here and why
Last checked on
The Measures and evidence group is where you describe what your organisation actually does to protect itself, keep the evidence that it works, plan reviews and manage your policies and procedures.
Why this protects your organisation
A customer sending you a security questionnaire, or an auditor on site, wants more than to hear that you make backups. They want to see how it is done, who does it and that it really happened last month. This group ties those three together: the agreement (a document), what you do (a measure) and the evidence that it works. ISO 27001 asks for controlled documentation in clause 7.5 and for checking that your measures work in clause 9.1.
Steps
- Record your key policies and procedures under Documents, and approve them.
- Describe what your organisation actually does under Measures, and link each measure to the risks it reduces.
- Add files or links under Evidence that show a measure works, and link them to that measure.
- Plan under Reviews when you will look at your documents, measures and evidence again.
The screens in this group refer to one another. A measure reduces risks and covers requirements of a standard, evidence shows that the measure works, and a review keeps all of it up to date.
- Measures: what your organisation does to protect itself, with an owner, a type and a signal that tells you whether the measure is still working.
- Evidence: files and links that show a measure works, with a date until which they are valid.
- Reviews: planned check moments for documents, risks, suppliers, measures and evidence. Once you complete one, the next is scheduled for you.
- Documents: policies, procedures, work instructions, forms and records, each with versions you approve and can ask colleagues to read.
Anything coming up for review also appears under Due for review in the Today group.
If it does not work
I cannot create or change anything in this group
An advisor can read along but not edit by default. The workspace owner can grant edit rights for the Risks and controls module (measures, evidence and reviews) or the Policies and documents module (documents).
A measure shows Needs attention
That means its review date has passed or it has no active, valid evidence linked. Open the measure to see the reason in one sentence.