ISO 27001 audit: what the auditor will ask for

1. 1.

   Please provide the documented technical vulnerability management policy.

   The auditor checks whether an approved document defines roles, scan frequency and remediation deadlines, and whether practice matches it. A policy without evidence of use is not enough.

   Secvalis covers part of thisVM policy documentVM procedure

   Obszar: udokumentowane polityki i procedury zarządzania podatnościami

2. 2.

   Please provide the inventory of systems in scope of scanning, and what was excluded.

   The question covers not only the vulnerabilities found but also machines outside the scan scope. The inventory must be reconcilable with the real estate, and exclusions justified.

   Secvalis covers part of thisMachine inventory + contextAsset criticality

   Obszar: wykaz aktywów i zakres objęty zarządzaniem podatnościami

3. 3.

   Please provide evidence that scanning is recurring, not a one-off before the audit.

   History is what counts: dates of consecutive scans and fleet coverage over time. A single report from last week only proves the tool runs.

   Secvalis generates this evidenceRemediation SLA tracking + coverage report

   ISO/IEC 27001, Załącznik A: A.8.8 (zarządzanie podatnościami technicznymi)

4. 4.

   Please provide defined remediation deadlines by severity, and evidence they are met.

   The auditor asks two things at once: whether deadlines exist and how many were met. Overdue items are typically the subject of separate questions about cause and handling.

   Secvalis covers part of thisRemediation SLA tracking + coverage reportCVE/KEV feed in prioritisation

   ISO/IEC 27001, Załącznik A: A.8.8 (zarządzanie podatnościami technicznymi)

5. 5.

   Please provide the register of consciously accepted vulnerabilities, with justification and review date.

   Not every vulnerability can be fixed. The auditor wants to see that the decision to accept was deliberate, taken by an authorised person and time-boxed, rather than the issue quietly dropping off the list.

   Secvalis covers part of thisRisk-acceptance registerAcceptance-to-change link

   Obszar: postępowanie z ryzykiem i świadoma akceptacja ryzyka przez uprawnioną osobę

6. 6.

   Please provide the trail of who changed a vulnerability status or accepted a risk, and when.

   This is a question about accountability. It usually concerns an event log identifying the person, time and type of change, exportable and readable outside the system.

   Secvalis covers part of thisActivity logActivity log / scans

   Obszar: rozliczalność — zapisy zdarzeń i decyzji

7. 7.

   Please provide the list of systems without vendor support and the plan for them.

   A system past end of life no longer receives fixes, so no patching process can defend it. Questions usually concern whether such a system is known, justified and has a defined exit date.

   Secvalis covers part of thisFleet EOL report

   ISO/IEC 27001, Załącznik A: A.8.8 (zarządzanie podatnościami technicznymi) — systemy bez wsparcia producenta

8. 8.

   Please provide the list of people with access to the tool and how they authenticate.

   A vulnerability management tool is itself a sensitive asset — it knows the weak points of the whole estate. The auditor checks the scope of permissions and the second authentication factor.

   Secvalis covers part of thisAccount member MFA stateMFA enforcement + member coverage

   ISO/IEC 27001, Załącznik A: A.5.18 (prawa dostępu) oraz uwierzytelnianie użytkowników

9. 9.

   Please explain how you protect evidence from being altered after the fact.

   This usually comes up when the evidence is convenient for the organisation. It concerns how an evidence pack for a closed period is produced, how evidence is collected, and what would reveal a later modification.

   Secvalis generates this evidenceFrozen periods / evidence pack

   Obszar: zbieranie i zabezpieczanie dowodów

10. 10.

    Please provide evidence of staff training and awareness activities.

    Attendance lists, materials, dates, topics covered. This evidence is about people, not systems, so no scanning tool can produce it.

    You prepare this yourself

    This evidence concerns people and a training process that Secvalis does not observe.

    Obszar: kompetencje i świadomość personelu

11. 11.

    Please provide evidence of backups and the result of a restore test.

    Making backups is not enough — the auditor asks about restoring them, because only that proves the backup is usable.

    You prepare this yourself

    Backups and restore tests are handled outside the platform.

    Obszar: kopie zapasowe i odtwarzanie danych

12. 12.

    Please provide the management review minutes and security objectives for the next period.

    The auditor checks whether management actually looks at the data and makes decisions. A report nobody discussed is not evidence of oversight.

    You prepare this yourself

    The management review is a management activity; the platform supplies data for it but does not conduct the review.

    Obszar: nadzór kierownictwa nad systemem zarządzania i cele bezpieczeństwa

13. 13.

    Please provide security requirements for supplier relationships and evidence they are applied.

    This covers contracts, procurement requirements and supplier reviews. The scope goes beyond technical infrastructure.

    You prepare this yourself

    Supplier relationships are an organisational process outside the platform's scope.

    Obszar: bezpieczeństwo w relacjach z dostawcami

Informational material, not legal advice. The list is indicative and not exhaustive — the scope of requests depends on the auditor, the certification body and the specifics of the organisation. It does not determine the reader's legal status or the outcome of an audit.