Start with an agreed scope and the current official Assessment Submission Record (ASR). Your submission should describe your own organisation and point to evidence that supports each answer. A large folder of unrelated policies makes the review harder.
Connect the requirement to what actually happens
For each control, work through four questions: what outcome is required, who is responsible, what happens in practice and how can someone verify it? Write the answer in your own context, then reference the relevant record or demonstration.
For example, an access procedure might explain how leavers are handled. A completed request and dated account review can show the process operating. A demonstration can show the current account state. Those are different pieces of evidence; none should be fabricated to make a submission look complete.
| Evidence | Useful for | Limit to recognise |
|---|---|---|
| Policy or procedure | Explaining responsibilities and the intended process. | It does not show the process operates. |
| Operating record | Showing a dated action, decision or review. | One record may not cover the whole scope. |
| Practical demonstration | Showing how an examined control works. | It does not establish the position in unrelated systems. |
Practical evidence examples
These are illustrative organising ideas, not an exhaustive control list or a promise that a particular document will be accepted. Use the current applicant guide for the requirement and discuss uncertainties with your assessor.
- Responsibility: a named owner, agreed duties and evidence that decisions are reviewed.
- Assets and access: maintained inventories, approved changes and records of access review.
- Resilience: a recorded recovery need, implemented safeguards and results of a suitable recovery check.
- Detection: the services monitored, who reviews alerts and an example of how an event was handled.
- Incident response: roles, escalation routes and lessons or actions from a real event or appropriate exercise.
- Suppliers: responsibilities, relevant agreements and evidence the provider can make available.
Build an evidence index people can use
Give each evidence item a reference. Record the document or system, date or version, specific page or section, owner, secure location and the answer it supports. If one item supports several answers, reference it consistently.
Separate planned actions from completed work. An action log should show the gap, owner, due date and evidence needed to close it. It should not silently convert an intention into a statement that a control is operating.
What makes an evidence reference useful?
“See policy folder” leaves the reviewer to find the connection. Identify the particular document, its version, the relevant section and the control or answer it supports. For a system report, record its date, coverage, owner and the point it helps establish.
For example, a fictional evidence index could identify a dated access-review record, its specific section and the team responsible. That shows the structure of a reference; it is not a model assessment answer or proof that your organisation runs the process.
Check the coverage as well as the document. A current report covering office laptops may omit remote devices or a supplier-managed service. Record the gap and obtain the appropriate information instead of silently extending the claim.
Prepare the people who will demonstrate the controls
Confirm who can explain each area and how they will access the relevant systems during practical verification. Check remote staff availability, provider involvement and any site arrangements early. Agree the assessment and clarification process with your certification body.
Useful preparation includes finding the correct record, checking that a referenced document is current and confirming access works. It does not mean rehearsing a scripted answer that differs from normal operations.
Can we reuse ISO 27001 evidence or supplier reports?
Use relevant existing records where they actually support the DCC requirement and agreed scope. Check versions, coverage and ownership. Holding another certificate does not automatically meet DCC controls, and a supplier’s general assurance statement may leave responsibilities or system coverage unexplained.
Ask your provider which records they can make available, who can explain them and what access or confidentiality arrangements are needed. Agree these before the assessment date.
Keep preparation and assessment responsibilities clear
DSC can explain DCC requirements and assess Levels 0 and 1. A DCC certification body must not implement controls or create answers and evidence that it later assesses. Discuss existing supplier relationships and the required conflict of interest declaration early.
If you need an IT provider to implement or run the controls, arrange that work with the assessment independence requirements in mind. Where DSC provides implementation or managed IT, an appropriate independent DCC assessment arrangement is needed. A separate invoice alone does not resolve the conflict.
Turn the evidence plan into an assessment timetable
Bring your required level, draft scope, existing certificates and a high-level summary of evidence readiness. We can identify what needs clarifying and quote the assessment work. Keep sensitive evidence out of the public contact form.
Talk to us about a DCC Level 1 assessment or read the assessment process.
Checked on 24 October 2026 against the IASME public applicant and process guidance, including Applicant Guide v2.2. Follow the current formal guidance for submission, scoring, retention and secure access.