For many UK SMEs, the difficult question is no longer “Do we have an IT policy?”
It is:
“Can you show me that it is current, implemented, tested and owned?”
That is the question asked by auditors, insurers, banks, enterprise customers and increasingly cautious boards. A policy may describe the intended control. An evidence pack demonstrates what actually happens.
The difference is important. A written backup policy is not proof that backups are completing. An access-control procedure is not proof that leavers are removed promptly. A Disaster Recovery plan is not proof that the business can restore critical operations within an agreed timeframe.
An IT Evidence Pack turns these statements into an auditable management tool. It brings together the documents, reports, logs, test results, decisions and remedial actions that show the organisation is secure, resilient and financially controlled.
Controls are not evidence until they can be demonstrated
A mature evidence pack should answer five straightforward questions for every important control:
- What is the control?
- Who owns it?
- How often is it performed or reviewed?
- What records prove it happened?
- What changed when a weakness was found?
This is where consultancy-led IT support creates value. The goal is not to produce a large folder of screenshots just before an audit. It is to establish a repeatable operating rhythm, with evidence created naturally through governance, support and change management.
The NCSC guidance on asset management makes the underlying principle clear: it is easier to protect assets that are known, classified and maintained. That includes hardware, software, cloud services, information, accounts, suppliers and the people whose knowledge keeps critical systems operating.
For directors, the evidence pack should be concise enough to understand but detailed enough to defend.
Cyber Essentials and ISO 27001: practical evidence domains
For most UK SMEs, Cyber Essentials is a sensible baseline. It focuses attention on five core technical areas:
- firewalls and internet gateways;
- secure configuration;
- user access control;
- malware protection; and
- patch management.
The Cyber Essentials scheme is not simply a badge to display. It provides a useful starting point for collecting evidence that basic controls are configured and maintained.
An evidence pack might include:
- a current asset and software inventory;
- records of supported operating systems and devices;
- patching and vulnerability reports;
- privileged-account and user-access reviews;
- MFA coverage and documented exceptions;
- firewall and endpoint protection summaries;
- secure configuration checks;
- incident records and escalation contacts; and
- supplier and cloud dependency reviews.
ISO 27001 alignment or certification takes the organisation into a wider management system. It asks how security risks are identified, assessed, treated, monitored and improved over time.
That means assessors will expect to see more than technical settings. They will look for:
- a defined scope;
- an information-security policy;
- a risk assessment and treatment plan;
- clear ownership of controls;
- supplier and cloud-service reviews;
- access-control processes for joiners, movers and leavers;
- incident response arrangements;
- management review; and
- evidence that corrective actions are tracked to completion.
In practice, Cyber Essentials provides a useful technical baseline, while ISO 27001 provides the governance structure around it. Neither should be treated as a one-off compliance exercise.
Disaster Recovery evidence must follow business processes
Disaster Recovery is often documented around servers. The business, however, does not operate in servers. It operates in processes.
A useful evidence pack defines recovery time objectives (RTOs) and recovery point objectives (RPOs) for activities such as:
- taking customer orders;
- processing payments;
- producing invoices;
- accessing clinical or case records;
- communicating with customers;
- dispatching goods; and
- paying staff and suppliers.
The question is not merely “How quickly can we restore the database?” It is “How quickly must this business process be available, and how much data can the organisation afford to lose?”
Evidence should then show:
- the agreed RTO and RPO for each critical process;
- the systems, suppliers and people required to support it;
- backup schedules and retention settings;
- restore-test dates, scope and results;
- identified failures or delays;
- assigned remediation actions;
- revised procedures following lessons learned; and
- management sign-off.
The recovery chain is broader than the main application. Identity services, DNS, internet access, Network Solutions, remote access, mobile devices and Voice and Connectivity may all be required before staff can work.
A restored system that nobody can log into is not a recovery. A working application with no connectivity or telephony may still leave the business unable to serve customers.
The strongest evidence is created through testing. A tabletop exercise, partial restore or full recovery rehearsal should produce a short report: what was tested, what worked, what failed, who owned the action and when it will be retested.
That is evidence an insurer, auditor or board can use.
Dynamics 365 Jump Start should leave a documentary trail
A Dynamics 365 Jump Start should be treated as a governed business programme, not merely a software deployment.
Whether the project involves Dynamics 365 Business Central or another core platform, the evidence trail should begin before configuration starts. A board-facing implementation file should normally include:
Discovery
Document the business processes, pain points, decision-makers, integrations, reporting requirements and known constraints. This establishes why the project exists and what success means.
Data readiness
Record data sources, ownership, quality issues, retention requirements, cleansing decisions and migration responsibilities. Data that has not been assessed is a cutover risk waiting for a calendar invite.
Security design
Define roles, segregation of duties, privileged access, MFA, approval workflows and relevant supplier responsibilities. Keep approved role designs and access-review records.
Integration planning
Map connections to banking, payroll, ecommerce, logistics, document management and legacy platforms. Record data flows, failure points, monitoring responsibilities and recovery dependencies.
Cutover
Maintain a cutover plan with entry criteria, rollback decisions, communications, named owners and timings. The aim is to show not just that the system went live, but that the organisation understood the operational risk of doing so.
Post-go-live support
Keep issue logs, change approvals, training records, support trends and lessons learned. Helpdesk Support becomes part of the governance record when tickets reveal recurring control or process weaknesses.
This approach makes the implementation easier to audit and easier to recover. It also prevents the familiar problem of a new system becoming operationally important before its dependencies have been documented.
IBM i Management: document the specialist knowledge
For organisations that depend on IBM i Management, the evidence pack should recognise legacy infrastructure as a high-value specialist consultancy discipline.
The risk is rarely the platform alone. It is the undocumented knowledge surrounding it.
A useful IBM i Management section should record:
- core applications and business processes;
- interfaces with modern systems and external suppliers;
- batch schedules and dependencies;
- user accounts and privileged access;
- backup configuration and recovery procedures;
- hardware, hosting and support arrangements;
- operational monitoring;
- key-person dependencies;
- succession and knowledge-transfer plans; and
- recovery steps that have actually been tested.
This is particularly important when an organisation is modernising other parts of its estate. The objective is not to dismiss heritage systems as technical debt. It is to understand their commercial value, document their dependencies and manage their risks deliberately.
A specialist IBM i Management review can turn “only one person knows how it works” from a worrying anecdote into a measurable succession and continuity action.
Technology Expense Management is evidence of cost governance
Resilience needs funding. Funding decisions need evidence.
Technology Expense Management provides the financial layer of the evidence pack by keeping visibility of:
- software licences and subscription tiers;
- renewal dates and notice periods;
- hardware and support contracts;
- cloud consumption;
- telephony and connectivity charges;
- actual user and system usage;
- duplicate or overlapping tools;
- dormant accounts and unused licences; and
- business justification for material technology spend.
This is more than procurement housekeeping. It demonstrates that the organisation understands what it is paying for, why it is paying for it and where savings can be redirected into resilience.
A licence register may reveal that a security feature is already available but not enabled. A contract review may identify a renewal approaching before the business has assessed its alternatives. Usage data may show that a critical service is underfunded, over-provisioned or dependent on a single supplier.
Good Managed IT Services should create operational evidence. Technology Expense Management ensures that evidence also supports commercial decision-making.
What should the IT Evidence Pack contain?
At a minimum, a UK SME should be able to assemble the following:
- a controlled evidence index with owners and review dates;
- current asset, data, application and supplier inventories;
- Cyber Essentials control evidence;
- risk assessment, risk treatment plan and outstanding actions;
- access-control and privileged-account reviews;
- patching, vulnerability and endpoint reports;
- incident response plan, contacts and incident log;
- Disaster Recovery plans with process-level RTOs and RPOs;
- backup, restore and recovery-test results;
- network, identity, connectivity and telephony dependencies;
- Dynamics 365 Jump Start programme documentation where relevant;
- IBM i Management dependencies, recovery procedures and succession actions where relevant;
- Technology Expense Management records for licences, contracts and usage;
- change records and post-implementation reviews;
- staff training and awareness records; and
- board-level summaries showing decisions, risks and progress.
The pack should be reviewed at an agreed cadence, not rediscovered during an audit panic. That may be monthly for operational evidence and quarterly for board reporting, risk treatment and supplier review.
At Evestaff IT Support and Consultancy, the consultancy-first approach is to connect strategy, evidence and execution. Specialist partners can provide focused technical delivery where required, while the overarching IT direction remains clear, measurable and aligned with business priorities.
For the wider Evestaff group of services, visit evestaff.co.uk.
SEO tags: IT Evidence Pack, UK SME IT compliance, Cyber Essentials, ISO 27001, Disaster Recovery, Dynamics 365 Jump Start, IBM i Management, Technology Expense Management, Managed IT Services, Cloud Solutions, Helpdesk Support, Network Solutions, Voice and Connectivity, IT consultancy UK
Join The Discussion