A.5.26 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that confirmed information security incidents are responded to according to documented procedures and that response decisions, actions, responsibilities, and follow-up are recorded.

Evidence to request

Strong evidence

• Incident records map to documented procedure steps.
• Roles and responsibilities are visible in the response record.
• Containment, eradication, recovery, communication, and closure decisions are timestamped.
• Evidence collection decisions are made early and recorded.
• Management approval is present for high-impact decisions.

Weak evidence

• A plan exists but incidents are handled entirely in chat.
• No timestamps or decision log.
• No evidence of containment or recovery validation.
• Responsibilities are unclear during response.
• Evidence needs are considered only after systems are changed.

Sample interview questions

• Show an incident record and the documented procedure it followed.
• Who owned containment, communication, recovery, and closure?
• When was the evidence-collection decision made?
• What management approvals were required?
• How were follow-up activities recorded?

Common nonconformities

• Procedures are too generic to guide real response.
• No nominated contact or reporting line.
• Response actions are not recorded.
• Legal/privacy/comms are involved too late.
• Teams destroy evidence while trying to restore service.

Related notes

• A.5.26 Response to Information Security Incidents
• Incident Response Record
• A.5.26 Audit Checklist