Study 04 · Compliance demonstration · C
From requirement
to actual evidence.
A fictional organisation has not routinely checked who can access its shared systems. Explore how to separate a standard reference, a specific risk, a proposed control and the evidence that would prove the control was actually performed.
Risk → control → evidence
A simple access-review control.
These are illustrative professional design decisions, not a compliance audit or a claim that a standard certifies this fictional organisation.
Why could that matter?
Who must do what?
What would prove it happened?
Did it work?
ISO/IEC 27001:2022 and ISO/IEC 27002:2022 may inform risk-based control design; current UK privacy obligations require separate applicability analysis. Refer to official sources, not copied standards text.
Limitations
The important distinction
A requirement can exist without an implemented control, and a control can be documented without being exercised. The fictional evidence record explains what an actual reviewer would have to verify. Nothing here constitutes professional certification, legal advice or an assessment of a real employer.