Checklist: SharePoint Libraries, Lists, and Permissions Needed for ISO 27001 Evidence

Introduction

ISO 27001 evidence gets messy fast when SharePoint is not structured properly.

• Policies sit in one folder.
• Risk registers live in Excel.
• Vendor reviews are scattered.
• Corrective actions are tracked in email.
• Access review evidence is saved without context.
• Audit files are copied into multiple places.

In simpler terms: a strong SharePoint ISO 27001 evidence setup needs the right libraries, the right lists, and the right permissions before audit pressure begins.

Why SharePoint Structure Matters for ISO 27001

SharePoint can be an excellent ISO 27001 evidence workspace. But only if it is designed as an ISMS operating environment, not just a document dump.

A good SharePoint setup helps the team manage:

• controlled policies
• risk records
• Statement of Applicability evidence
• access reviews
• vendor reviews
• incident records
• corrective actions
• internal audits
• management reviews
• monthly evidence collection

Part 1: SharePoint Libraries You Need

1. Policy and Procedure Library

This library should store controlled documents such as:

• information security policy
• access control policy
• risk management procedure
• incident response plan
• vendor management policy
• acceptable use policy
• backup and recovery procedure
• secure development policy
• data classification policy

2. Audit Evidence Library

This is the main evidence storage area. It should hold:

• screenshots
• system reports
• access review exports
• training reports
• backup test records
• vendor evidence
• incident records
• change management samples
• meeting minutes

3. Internal Audit Library

Use this library for:

• audit plans
• audit checklists
• interview notes
• evidence request files
• internal audit reports
• audit schedules

4. Management Review Library

Use this library for:

• meeting agendas
• management review presentations
• minutes
• risk summaries
• corrective action summaries
• incident summaries
• improvement plans

5. Templates Library

Create one controlled library for standard templates:

• risk assessment template
• risk treatment plan
• access review template
• vendor review template
• incident record template
• corrective action template
• internal audit checklist
• management review agenda
• evidence request form

Part 2: SharePoint Lists You Need

1. Risk Register

Use a SharePoint List instead of a static spreadsheet.

2. Statement of Applicability Tracker

The SoA should be structured and easy to update.

• control ID
• control name
• applicability
• justification
• implementation status
• control owner
• related policy
• evidence link

3. Corrective Action Tracker

Use this for audit findings, incidents, risk treatment actions, and improvement items.

• action ID
• source
• issue description
• root cause
• owner
• priority
• due date
• status
• evidence link

4. Vendor Register

Use this list to manage supplier risk. Recommended fields include:

• vendor name
• service provided
• business owner
• data handled
• criticality
• security evidence reviewed
• contract or DPA status
• last review date
• next review date

5. Access Review Tracker

Use this list to track access reviews across key systems. Recommended fields include:

• system name
• review period
• reviewer
• user list link
• changes required
• removal evidence
• approval date
• status

6. Incident Register

Track incidents and near misses with fields such as:

• incident ID
• date detected
• reported by
• incident type
• severity
• owner
• affected systems
• response actions
• closure summary
• corrective action link

7. Evidence Request Tracker

Use this during audits and monthly evidence collection. Recommended fields include:

• request ID
• audit or review name
• control area
• evidence requested
• evidence owner
• due date
• status
• evidence link
• reviewer notes

Part 3: Permissions You Need

1. Use Least Privilege

Not everyone needs access to all ISO 27001 evidence.

Restrict sensitive areas such as:

• incident records
• vulnerability reports
• audit findings
• risk register
• management review materials
• vendor weaknesses
• access review evidence

2. Create Permission Groups

3. Separate Sensitive Libraries

Do not store everything in one open site. Create tighter permissions for:

• incident records
• internal audit findings
• vulnerability evidence
• access reviews
• executive management review

4. Control External Sharing

External auditor or consultant access should be:

• time-limited
• read-only where possible
• restricted to relevant folders or libraries
• reviewed and removed after use

5. Review Permissions Regularly

Create a quarterly permission review for the ISMS site. Check:

• who has access
• guest users
• broken inheritance
• direct permissions
• group membership
• inactive users
• external links

Part 4: Useful SharePoint Views

Create filtered views to reduce manual work.

Common Mistakes to Avoid

1. Using folders only: Folders do not track status, owners, due dates, or control mapping.
2. Giving everyone access to everything: Oversharing creates audit and data exposure risk.
3. Keeping risk and corrective actions in Excel forever: Lists are better for live tracking and accountability.
4. Uploading evidence without metadata: Evidence without context is hard to defend.
5. Forgetting permission reviews: An ISMS site can become risky if access is not reviewed.
6. Not linking evidence to controls: Auditors need to see what each file proves.

Canadian Cyber’s Take

At Canadian Cyber, we often see organizations using SharePoint for ISO 27001 but missing the structure needed to make it audit-ready.

The best SharePoint ISMS setups combine:

• controlled libraries
• structured lists
• metadata
• filtered views
• tight permissions

Takeaway

For ISO 27001 evidence, SharePoint should be built around three things:

• Libraries for controlled documents and evidence.
• Lists for live tracking of risks, vendors, actions, incidents, and audits.
• Permissions that protect sensitive records while enabling collaboration.

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on SharePoint ISMS setup, ISO 27001 evidence, audit readiness, permission governance, and vCISO support.