Can evidence cover several customer engagements?

Only if its content, period and scope actually fit and sharing is permitted. Reuse is not blanket approval.

ISO 27001 software for IT providers: Answer customer questions faster

One customer asks how you control privileged access. Another wants evidence for an outsourced operational service. A third has its own questionnaire. Rebuilding folders each time turns security into a bottleneck for sales and operations.

For IT providers, ISO 27001 software needs to connect customer questions with the service delivered. An offboarding test spanning internal and customer access shows whether responsibilities and evidence align.

Your own ISMS is not your customer’s ISMS

Separate three situations: protecting your own organisation, operating a service for customers and helping customers establish their ISMS. These create different requirements for scope, roles and data access.

Evidence for your internal helpdesk does not automatically cover administrative access to a customer environment. Even when the same employees are involved, responsibility and service scope differ.

With several customer engagements, test access separation too: search, downloads and linked objects must not expose another customer’s information. A visible tenant filter alone does not prove separation.

From service to a suitable answer

Take a specific managed service. Document which systems you operate, what the customer decides and which subcontractors are involved. This determines the measures whose evidence you actually need later.

Kopexa provides organisation and Space structures, information assets, other assets, risks and measures. Evidence stays with implementation; measures can be mapped to relevant controls. This supports reuse of suitable evidence without extending its validity to other services.

Preserve this service perspective during implementation. Beyond importing an old control list, check which customer service each implementation protects.

The offboarding test reveals the actual depth

An administrator leaves. Test the workflow for your own organisation and two customers with different responsibilities.

Access	Who implements?	What must completion demonstrate?
Your administration systems	Your operations team	Affected access revoked
Access managed by a customer	Responsible person at the customer	Confirmed implementation by the customer
Shared emergency access	Responsible operational roles	Controlled change and remaining access capability

A BPMN process can make these handovers visible in Kopexa. Evidence attached to measures then shows which parts are complete. A completed internal task must not conceal missing customer confirmation.

Use sanitised test data and restricted accounts. The result should explain which residual access remains and who will resolve it.

What a real customer case contributes

CSN Solutions uses Kopexa for its ISMS. Its ISO 27001:2022 recertification report identifies the provision of Kopexa for documenting compliance and risk management as a strength. The case study shows how the IT provider organises its established security work with the platform. The standard's requirements and controls are in our ISO 27001 overview.

Your own service scope and responsibility boundaries remain decisive. If an external information security officer participates, also test collaboration and subsequent handover: information must remain usable by your organisation.

Selection objective: Answer customers without stopping operations

A suitable solution does not eliminate every individual response. It shortens the search for a dependable basis and shows where a statement is not yet supported. Bring a recurring customer questionnaire and a sanitised service case into Kopexa’s guided trial.