Mandatory
Evidence: Short description of your building controls: lockable doors and cupboards, clear desk procedure, key-coded areas
Mandatory
Evidence: Names and roles of the people with overall responsibility, and how it was formally assigned (job description, meeting minutes or an email from a director)
Mandatory
Evidence: Information asset register (IAR) and record of processing activities (ROPA), in one document or two, reviewed and approved by management in the last 12 months
Mandatory
Evidence: Current policies with review dates, updated at least every three years (an annual review is good practice)
Mandatory
Evidence: Induction checklist or programme showing the data security content, with records that new starters completed it
Mandatory
Evidence: Contract or agreement template showing the confidentiality and data security clause
Mandatory
Evidence: Training completion records for every staff member (certificates, completion dates, training provider)
Mandatory
Evidence: Staff list with roles, plus which systems each role can access
Mandatory
Evidence: Joiner/leaver process documentation and a log of access removals with dates
Mandatory
Evidence: Signed agreement, or contract or job-description clause, for each administrator, including your IT supplier's
Mandatory
Evidence: A short record of each post-incident process review and what changed, or "Not applicable" if there were no breaches or near misses
Mandatory
Evidence: Incident reporting procedure, evidence that staff know it, and an incident log (even if empty)
Mandatory
Evidence: Breach record showing the risk assessment and any notification decision, or "Not applicable" if there were no breaches
Mandatory
Evidence: Anti-virus/anti-malware solution name, update frequency, and coverage confirmation
Mandatory
Evidence: Business continuity plan covering IT failure, cyber attack, and data loss scenarios
Mandatory
Evidence: Record of the last review and of a test or exercise in the last 12 months, which item 7.2.1 asks for (date, who took part, findings, actions taken)
Mandatory
Evidence: IT asset register showing OS versions and software inventory with support status, plus a documented risk assessment and management plan for any unsupported items
Mandatory
Evidence: Patching schedule or IT supplier confirmation of automatic patching
Mandatory
Evidence: Confirmation of encryption on devices (BitLocker/FileVault), from you or your IT supplier
Optional
Evidence: IT supplier statement confirming firewall configuration, or network diagram
Mandatory
Evidence: Supplier list: name, products or services, contact details, and the personal information they handle
Mandatory
Evidence: Supplier assurance letters, certificates (Cyber Essentials, ISO 27001) or DSPT status for key suppliers
Optional
Evidence: Data processing agreements (DPAs) with IT suppliers and cloud service providers