October 2026. The transition to ISO 27001:2022 is complete for everyone, so the controls that were new then are now simply part of the audit. In practice, five controls in particular lead to follow-up questions. This is what the auditor wants to see. An overview of all controls is at Annex A.
5.23 Information security for use of cloud services
The question: which cloud services do you use, who is responsible for what and how do you exit? Show a service inventory with owners, the split of responsibilities (shared responsibility) and an exit approach. A service missing from the inventory is often found by the auditor through the invoices.
5.30 ICT readiness for business continuity
Auditors ask whether your recovery targets (RTO and RPO) derive from what the business needs, and whether they have been tested. A document with targets but no test result is a finding in the making. See backup and recovery and business continuity.
8.9 Configuration management
How do you know servers, laptops and SaaS settings are in the intended state? Show baselines, a deviation process and evidence that deviations are followed up, for example from your MDM or a configuration scan.
8.10 Information deletion
This is the control many SMEs have recorded nothing about. Auditors want to see when data is deleted, how that happens and that it also applies to backups and suppliers. A retention overview plus an example of a completed deletion is enough.
8.16 Monitoring activities
Who looks at the logs, what triggers an alert and what happens next? Auditors ask for a recent alert and how it was handled. Alerts nobody reads do not count as monitoring.
How to prepare
Pick one owner and one recent example per control. Walk through the story before the auditor does: what is the policy, who carries it out and where is the evidence? More on preparation at audit preparation.