ISO/IEC 27001 Audit Readiness in Saudi Arabia: Evidence Before Stage 1 and Stage 2

Audit readiness means evidence readiness

Many teams treat ISO/IEC 27001 audit preparation as a paperwork job: collect the policies, write the Statement of Applicability, tidy the folders. That work is needed, but it does not show that your information security management system (ISMS) actually works. The auditor will look for that.

ISO/IEC 27001:2022, together with its applicable amendment, is the current baseline. It uses a risk-based management system to protect the confidentiality, integrity and availability of information. Certification audits are carried out by independent certification bodies, not by ISO and not by the consultant who helped you prepare.

In Saudi Arabia, readiness also means knowing your legal, regulatory and contractual duties. Depending on your sector, these may include the Personal Data Protection Law (PDPL), National Cybersecurity Authority (NCA) controls, customer security clauses, sector rules and cross-border data requirements. The auditor is likely to test how you identify these obligations and turn them into risk treatment, controls and operating evidence.

Stage 1 vs Stage 2

Area	Stage 1 emphasis	Stage 2 emphasis
Purpose	Confirm scope, design, documented arrangements and readiness for the full audit	Evaluate implementation, conformity and effectiveness across the scope
Risk management	Method, criteria, results, risk owners and treatment approach hang together	Treatments are implemented, residual risks accepted and changes managed
Statement of Applicability	Control decisions are complete, justified and match risks and obligations	Selected controls operate and exclusions remain defensible
Performance	Monitoring approach, objectives, responsibilities and planned evidence are clear	Results, trends, exceptions, incidents and management decisions can be sampled
Governance	Roles, internal audit and management review arrangements are in place	Completed internal audits, reviews and corrective actions show oversight

What Stage 1 readiness looks like

Stage 1 is mainly a readiness and design review. The auditor learns about your organization, confirms the certification scope, reviews the key ISMS information and decides whether you are ready for Stage 2. It is not a shortened effectiveness audit, but it is more than a casual document check.

Scope. The scope should name the units, locations, technologies, services and interfaces in the ISMS, and the boundaries should make business sense. If a shared data center, cloud tenant, regional IT team or outsourced security provider supports an in-scope service, explain the dependency instead of hiding it behind a narrow statement.

Risk assessment. Show a repeatable method, agreed criteria and results that reflect your real environment. An asset list can support the assessment, but a list of servers is not a risk assessment. Auditors expect a logical link between business processes, information, threats, vulnerabilities, consequences, ratings, owners and treatment decisions.

Statement of Applicability. It should say which controls are relevant, whether they are implemented, and why any control is not applicable. It has to agree with your risk treatment plan, contracts, legal obligations and actual technology. A generic Statement of Applicability copied from a template is one of the quickest ways to create contradictions at Stage 2.

For our service, see ISO 27001 consultancy in Saudi Arabia.

What Stage 2 evidence looks like

At Stage 2 the auditor samples the working ISMS. Policies still matter, but records carry more weight. You should be able to show that people follow the process, controls produce the intended result, exceptions are caught and management acts when performance is weak.

The evidence depends on your scope and risks. Useful examples include approved access requests, periodic access reviews, privileged account monitoring, secure configuration checks, vulnerability and patch records, backup restore tests, supplier assessments, incident tickets and investigations, awareness results, change approvals and physical access logs. You do not need every possible record, only credible evidence for the controls you say you operate.

Good evidence is current, attributable and traceable: it shows the system or process, date, owner, result and follow-up. A screenshot with no context is weak. A report showing the source, period reviewed, exceptions, reviewer and action taken is much stronger. Samples should include failures, overdue actions and approved exceptions as well as normal operations.

Nine evidence areas to review before the audit

• Scope and context. Confirm the scope statement, locations, services, interfaces, interested parties, outsourced activities and the internal and external issues that matter. Record your conclusion on whether climate change is relevant to your ISMS context, as the 2024 amendment requires you to consider it.
• Risk assessment and treatment. Keep the method, criteria, latest assessment, risk owners, treatment decisions, acceptance records and evidence that changes trigger reassessment.
• Statement of Applicability. Check that control selections, exclusions, status and justifications agree with your risks, obligations and real operations.
• Operating controls. Build an evidence index that links each selected control to an owner, procedure, system record and recent sample. Do not create records just for the audit.
• Objectives and monitoring. Show measurable security objectives, responsibilities, progress, trends, and what was decided when targets were missed.
• Competence and awareness. Keep role requirements, training and onboarding records, awareness activities and evidence that people understood what is expected.
• Internal audit. Show a risk-based audit program, independent auditors, findings, reports and follow-up. The audit should test the ISMS, not just repeat the certification checklist.
• Management review. Keep the agenda, inputs, decisions, assigned actions and follow-up. Attendance alone does not show that leadership evaluated performance and risks.
• Corrective action. For findings, incidents and repeat weaknesses, show containment, cause analysis, ownership, completion and a check that the fix worked. Closing a ticket is not enough.

Saudi regulatory evidence: link obligations to the ISMS

ISO/IEC 27001 does not replace Saudi law or sector cybersecurity requirements. It gives you a management framework for identifying obligations and managing the related risks. Your evidence file should include a current register of obligations, decisions on what applies, named owners and records of how each requirement is monitored.

PDPL. If you process personal data, assess the PDPL and its implementing regulations against your activities. Official guidance says the law covers personal data processing in the Kingdom and can also reach processing from outside the Kingdom that relates to individuals residing in Saudi Arabia. Useful ISMS evidence includes data inventories, processing records, retention decisions, supplier controls, incident handling and cross-border transfer assessments.

NCA controls. Map NCA controls where they apply to your organization, sector or contracts. The NCA updated its Essential Cybersecurity Controls as ECC 2-2024 for national entities, and other NCA control sets may apply to critical systems, cloud, data or operational technology. Not every Saudi private company has the same NCA scope, so document your applicability analysis and where each obligation comes from.

Checklist before Stage 1

• The certification scope is clear, supportable and consistent across your application, ISMS documents and operations.
• The security policy, objectives, roles and governance are approved and communicated.
• The risk method, assessment, treatment plan and Statement of Applicability agree with each other.
• Applicable Saudi legal, regulatory, sector and contractual requirements are identified.
• Required documented information is controlled, current and available to process owners.
• Internal audit and management review are planned and far enough along to support readiness.
• Known gaps have owners and realistic closure plans before Stage 2.

Checklist before Stage 2

• Selected controls have operating records from real business activity across the scope.
• Objectives and monitoring results show trends, missed targets and management response.
• Access, change, vulnerability, backup, supplier, incident and awareness records trace to owners and periods.
• Internal audit findings are recorded, analyzed and followed through to closure.
• Management review decisions are documented and the actions are being tracked.
• Corrective actions include cause analysis and an effectiveness check, not just a completion date.
• Staff can explain their responsibilities in a way that matches the procedures and records.

Don't create an "audit month." Stage 2 evidence is stronger when it shows the ISMS working through normal operations, including how you handle exceptions, incidents, delays and changes. An honest record of a problem that was caught and dealt with is often more convincing than a folder of perfect records.

Common gaps that weaken readiness

• A scope that leaves out essential shared services without explaining the interfaces
• Risk results that ignore business processes, cloud services, suppliers or personal data
• A Statement of Applicability copied from a template and disconnected from real controls
• Policies approved just before the audit, with no evidence they were communicated or used
• Monitoring reports with no targets, trends, owners or action on poor results
• Internal audits done by people auditing their own work, or using only a clause checklist
• Management review minutes that record attendance but not evaluation, decisions or actions
• Corrective actions closed without finding the cause or checking they worked

Who prepares, who audits, who decides

Management owns the ISMS and its evidence, and process owners operate the controls. Internal auditors provide an independent internal check. A consultant can help interpret the requirements, structure documents, run risk workshops, train teams and carry out a readiness review, but should not manufacture evidence or take over management's accountability.

The independent certification body carries out Stage 1 and Stage 2 and makes the certification decision through its own process. No consultant can guarantee the outcome. Choose a competent, accredited certification body, since that supports confidence in the result. If your team needs internal audit skills, see our ISO 27001 internal auditor training and awareness training. For our wider service, and to compare standards, read ISO 14001 vs 45001 vs 27001.

Ask for a Stage 1 and Stage 2 readiness review

A readiness review finds contradictions before the certification audit does: scope boundaries that do not match operations, risk treatments without owners, control claims without records, unfinished internal audits, or corrective actions closed too early. We can review your scope, risk treatment, Statement of Applicability, control evidence, monitoring, internal audit, management review and corrective action records.