ISO/IEC 27001 Audit Readiness in Saudi Arabia: Evidence Before Stage 1 and Stage 2

Audit readiness is evidence readiness

ISO/IEC 27001 audit readiness in Saudi Arabia is often treated as a document-completion exercise. Teams collect policies, create a Statement of Applicability and organize folders for the auditor. Those actions are useful, but they do not by themselves show that an information security management system, or ISMS, is working.

The current certification baseline is ISO/IEC 27001:2022 together with its applicable amendment. The standard uses a risk-based management system to protect the confidentiality, integrity and availability of information. Certification audits are performed by independent certification bodies, not by ISO and not by the consultant who helped the organization prepare.

For a Saudi organization, readiness also requires a clear view of applicable legal, regulatory and contractual duties. Depending on the entity and sector, these may include the Saudi Personal Data Protection Law, National Cybersecurity Authority controls, customer security clauses, sector rules and cross-border data requirements. The auditor is likely to test how the organization identifies and converts relevant obligations into risk treatment, controls and operating evidence.

Stage 1 vs Stage 2: what changes?

Readiness area	Stage 1 emphasis	Stage 2 emphasis
Purpose	Confirm scope, design, documented arrangements and readiness for the full audit	Evaluate implementation, conformity and effectiveness across the agreed scope
Risk management	Method, criteria, assessment results, risk owners and treatment approach are coherent	Treatments are implemented, residual risks are accepted and changes are managed
Statement of Applicability	Control decisions are complete, justified and aligned with risks and obligations	Selected controls are operating and exclusions remain defensible
Performance	Monitoring approach, objectives, responsibilities and planned evidence are clear	Results, trends, exceptions, incidents and management decisions can be sampled
Governance	Roles, internal audit and management review arrangements support readiness	Completed internal audits, management reviews and corrective actions demonstrate oversight

What Stage 1 readiness should look like

Stage 1 is primarily a readiness and system-design review. The auditor develops an understanding of the organization, confirms the intended certification scope, reviews key ISMS information and determines whether the organization is prepared for Stage 2. It is not a shortened version of the effectiveness audit, but it is also more than a casual document check.

The scope should describe the organizational units, locations, technologies, services and interfaces included in the ISMS. Boundaries must make business sense. If a shared data centre, cloud tenant, regional IT team or outsourced security provider supports an in-scope service, the organization should explain the dependency rather than hide it behind a narrow statement.

Risk evidence should show a repeatable method, agreed criteria and results that reflect the real operating environment. Asset lists can support the assessment, but a list of servers is not a risk assessment. Auditors will expect a logical connection between business processes, information, threats, vulnerabilities, consequences, risk ratings, owners and treatment decisions.

The Statement of Applicability should then explain which control areas are relevant, whether they are implemented and why any control is not applicable. It should reconcile with the risk treatment plan, contractual commitments, legal obligations and actual technology. Copying a generic Statement of Applicability is one of the quickest ways to create contradictions for Stage 2.

For a service overview, see Qdot's ISO/IEC 27001 certification support in Saudi Arabia.

What Stage 2 effectiveness evidence should look like

Stage 2 is where the auditor samples the working ISMS. Policies still matter, but records carry more weight. The organization should be able to show that people follow the defined process, controls produce the intended result, exceptions are identified and management acts when performance is weak.

Evidence will vary by scope and risk. Useful examples include approved access requests, periodic access reviews, privileged-account monitoring, secure configuration checks, vulnerability and patch records, backup restoration tests, supplier assessments, incident tickets, investigation records, awareness results, change approvals and physical access logs. The objective is not to create every possible record. It is to preserve credible evidence for the controls the organization says it operates.

Good evidence is current, attributable and traceable. It identifies the system or process, date, owner, result and follow-up. A screenshot without context is weak. A report that shows the source, period reviewed, exceptions, reviewer and action taken is far stronger. Samples should cover normal operations as well as failures, overdue actions and approved exceptions.

Nine evidence areas to review before the audit

• Scope and context. Confirm the scope statement, locations, services, interfaces, interested parties, outsourced activities and relevant internal or external issues. Include the organization's conclusion on whether climate change is relevant to the ISMS context under the 2024 amendment.
• Risk assessment and treatment. Retain the method, criteria, latest assessment, risk owners, treatment decisions, acceptance records and evidence that changes trigger reassessment where needed.
• Statement of Applicability. Check that control selections, exclusions, implementation status and justifications agree with risks, obligations and actual operations.
• Operating controls. Build an evidence index linking each selected control to an owner, procedure, system record and recent sample. Avoid manufacturing records solely for the audit.
• Objectives and monitoring. Show measurable information security objectives, responsibilities, progress, results, trends and decisions when targets are missed.
• Competence and awareness. Keep role requirements, training records, onboarding evidence, awareness activities and evaluations that show whether people understood what was expected.
• Internal audit. Demonstrate a risk-based audit programme, auditor independence, competent audit work, findings, evidence, reporting and follow-up. The internal audit should test the ISMS, not merely repeat the certification checklist.
• Management review. Preserve the agenda, inputs, decisions, assigned actions and follow-up. Attendance alone is not evidence that leadership evaluated suitability, performance, risks and opportunities for improvement.
• Corrective action. For audit findings, incidents and recurring weaknesses, show containment where needed, cause analysis, action ownership, completion and effectiveness checks. Closing a ticket without verifying the fix is not enough.

Saudi regulatory evidence: connect obligations to the ISMS

ISO/IEC 27001 does not replace Saudi law or sector cybersecurity requirements. It gives the organization a management framework for identifying obligations and managing related risks. The evidence file should therefore include an up-to-date obligation register, applicability decisions, assigned owners and records showing how requirements are monitored.

Organizations processing personal data should assess the Saudi PDPL and its implementing regulations in relation to their activities. The official Saudi guidance emphasizes that the framework applies to personal-data processing in the Kingdom and can also reach processing related to individuals residing in Saudi Arabia from outside the Kingdom. Relevant ISMS evidence may include data inventories, processing records, retention decisions, supplier controls, incident handling and cross-border transfer assessments.

National Cybersecurity Authority controls should be mapped where they apply to the organization, its sector or its contracts. NCA updated the Essential Cybersecurity Controls as ECC 2-2024 for national entities. Other NCA control sets may be relevant to critical systems, cloud, data or operational technology. Do not claim every Saudi private company has the same NCA scope; document the applicability analysis and the source of the obligation.

Practical checklist before Stage 1

• The certification scope is clear, supportable and consistent across the application, ISMS documents and business operations.
• Information security policy, objectives, roles and governance have been approved and communicated.
• The risk method, assessment, treatment plan and Statement of Applicability reconcile with one another.
• Applicable Saudi legal, regulatory, sector and contractual requirements have been identified.
• Required documented information is controlled, current and accessible to process owners.
• Internal audit and management review have been planned and progressed sufficiently to support certification readiness.
• Known implementation gaps have owners and realistic closure plans before Stage 2.

Practical checklist before Stage 2

• Selected controls have operating records from real business activity across the agreed scope.
• Objectives and monitoring results show trends, missed targets and management response.
• Access, change, vulnerability, backup, supplier, incident and awareness records can be traced to owners and periods.
• Internal audit findings are recorded, analysed and followed through to closure.
• Management review decisions are documented and assigned actions are being tracked.
• Corrective actions include cause analysis and an effectiveness check, not only a completion date.
• Staff can explain their responsibilities consistently with the procedures and records.

Readiness principle: Do not create an artificial “audit month.” Stage 2 evidence is stronger when it shows that the ISMS works during normal operations, including how the organization handles exceptions, incidents, delays and changes. Honest evidence of a detected problem and a controlled response is often more credible than a folder containing only perfect records.

Common gaps that weaken audit readiness

• A scope statement that excludes essential shared services without explaining their interfaces.
• Risk results that do not reflect business processes, cloud services, suppliers or personal data.
• A Statement of Applicability copied from a template and disconnected from actual controls.
• Policies approved shortly before the audit with no evidence of communication or use.
• Monitoring reports with no targets, trend analysis, owner or action on poor performance.
• Internal audits performed by people auditing their own work or using only a clause checklist.
• Management-review minutes that record attendance but not evaluation, decisions or actions.
• Corrective actions closed without determining cause or checking effectiveness.

Who prepares, audits and decides?

Management owns the ISMS and its evidence. Process owners operate controls. Internal auditors provide an independent internal evaluation. A consultant may help interpret requirements, structure documentation, facilitate risk work, train teams and perform a readiness review, but should not manufacture evidence or take over management accountability.

The independent certification body conducts Stage 1 and Stage 2 and makes the certification decision through its own processes. No consultant can guarantee certification or decide the outcome. ISO explains that certification is provided by an independent body, while ISO develops the standard itself. Selecting a competent, appropriately accredited certification body supports confidence in the result.

For wider implementation assistance, review Qdot's ISO consultancy services in Saudi Arabia and its overview of ISO certification in Saudi Arabia.

Request an ISO/IEC 27001 Stage 1 and Stage 2 readiness review

A structured readiness review can identify contradictions before the certification audit: scope boundaries that do not match operations, risk treatments without owners, control claims without records, incomplete internal audits or corrective actions that were closed too early.

Request an ISO/IEC 27001 Stage 1 and Stage 2 readiness review from Qdot. The review can examine your scope, risk treatment, Statement of Applicability, control evidence, monitoring, internal audit, management review and corrective-action records. Qdot provides independent consultancy support; the certification audit and decision remain the responsibility of the selected certification body.