IT Audit Factory · Evidence-first audit operationsFree · Professional · MSP
IT Audit FactoryIT AUDIT FACTORYAudit, Evidence & Compliance Operations

Historical guide. This document retains its original version. See the current release guide for current build, storage and installer information.

Focused release in development: C31 supports new ISO 27001, CMMC Level 2, NIST SP 800-171 Rev. 2/3, NIST CSF 2.0 and NIST SP 800-53, HIPAA Security, ITAF ransomware readiness and PCI DSS preparation assessments. Other framework packs and advanced automation are in development. C12 is the owner-confirmed working baseline; C31 acceptance is pending.

Archived guide — original release identity

This guide describes a previous release. Use the current 4.1.0 documentation for new installations.

Documentation

Prepare for auditor review

Organize scope, owners, requests and evidence before the assessor review.

MSPR68 bundled reference
All documentation / MSP / R68 bundled reference
This reference is bundled with the R68 engine and may retain earlier UI terminology. Use the current R68 installation/security guides for the new wizard and activation steps. Its procedures apply to MSP; use the separate Free or Professional guide for those editions.

Auditor Preparation Guide

Preparing traceable, reviewable evidence without overstating automated conclusions
ITAuditFactory ISO 27001 Audit Toolkit 2.0.0-RC65

Before the audit

  1. Complete technical runs for applicable scopes.
  2. Resolve collector errors or document why evidence is unavailable.
  3. Review the Workbench evidence-gap register.
  4. Complete governance records and SoA decisions.
  5. Verify evidence integrity manifests.
  6. Generate the auditor package and retain the password separately.
A technical PASS is not an ISO certification decision. Preserve the distinction between collected evidence, interpretation, and auditor determination.

Guide basis

R68 package: Auditor-Preparation-Guide.html

Published as a website guide on 1 October 2026. Where a bundled reference is older, the version-specific guide and installed interface take precedence.

Email SupportBack to documentation