A supervisor will look for documents that show the measures exist and are followed, not only that they are written down. Good evidence is current, approved and linked to how work is actually done. A policy nobody follows is a finding, not a defence.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Keep an approved information security policy and risk assessment
- Store incident logs, test results and training records
- Date and version every document
Next steps
Collect evidence as part of normal work. Trying to gather it the week before a review rarely works. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.