The practical answer
Build labeling audit evidence backwards from the control being tested. Record the framework version and control text, define the population with its extraction date and exclusions, reconcile physical objects against records in both directions, and keep an exception log with owners, approvals and dates, including items still open. Identification evidence supports inventory and physical controls; it does not by itself satisfy them.
The method, examples, and sources below explain the scope and checks.
Start from the control being tested, not from the label#
An assessor does not ask whether your labels look tidy. They ask whether a stated control operates, and they test that claim against a population, a sample, and evidence. Labeling appears in that conversation because identification is how a physical object is connected to a record, and several common control families depend on that connection holding.
Begin by writing down the exact control text being tested, the framework and version it comes from, the period under review, and the person who owns the control. Everything else in this guide is downstream of that sentence. A labeling program that produces beautiful evidence for a control nobody is testing has not helped the assessment.
Keep one distinction visible throughout. Identification work can demonstrate that a physical object is uniquely named, that the name reaches an authoritative record, and that discrepancies were found and closed. It does not by itself demonstrate access control, media handling, change approval, or any other outcome those records support. Claiming more than the evidence shows is the fastest way to turn a helpful artifact into a finding.
Define the population before anyone samples it#
A sample is only meaningful against a defined population. Write down what the population is, where its boundary sits, and how it was derived: all cabinets in a room, all devices in an inventory export taken on a stated date, all cross-connects terminating in a cage, all removable media in a store. Record the extraction date and the query or report used, because a population that cannot be reproduced cannot support a reproducible test.
Reconcile in both directions before the assessor does. Records without a physical object and objects without a record are different failures with different causes, and an assessment that surfaces them for the first time is an uncomfortable place to discover which one you have. Run the comparison yourself, retain the result, and treat unresolved items as known exceptions rather than as noise to be tidied away.
State the exclusions explicitly. Equipment owned by a provider, tenant equipment in a shared cage, decommissioned assets awaiting collection, and spares in storage each have a defensible treatment, but only if the treatment is written down before the sample is drawn.
Map identification work to the control families that rely on it#
The mapping below is editorial. It shows where identification and record evidence commonly supports a control family, so that a labeling program can be aimed at the right artifacts. It is not a compliance interpretation, it is not a statement that any control is satisfied by labeling alone, and the assessor decides what is relevant to their engagement.
| Identification work | Commonly supports | Framework reference to read |
|---|---|---|
| Unique, non-reused identifiers reaching an authoritative record | Asset inventory completeness and ownership | ISO/IEC 27001 Annex A asset controls; NIST SP 800-53 Rev. 5 CM-8 |
| Physical-to-record reconciliation with dated exceptions | Inventory accuracy and monitoring | NIST SP 800-53 Rev. 5 CM-8 enhancements; AICPA Trust Services Criteria common criteria |
| Cable and port identification tied to a documented patch schedule | Cabling and transmission protection | ISO/IEC 27001 Annex A physical controls |
| Device lists carrying location and serial detail | Cardholder data environment inventory and device lists | PCI DSS document library |
| Media identification and movement records | Media handling and accountability | ISO/IEC 27001 Annex A media controls; NIST SP 800-53 Rev. 5 media family |
| Decommission tagging and closure records | Change closeout and secure disposal evidence | NIST SP 800-53 Rev. 5 configuration management family |
| Marking of components and emergency controls | Physical and environmental protection | NIST SP 800-53 Rev. 5 physical and environmental family |
Read the actual control text in the version that applies to your engagement before using any row. Framework editions change, numbering changes with them, and a mapping copied from a web page into a control matrix without that reading is exactly the sort of artifact that produces a finding of its own.
Decide what counts as evidence before collecting it#
Evidence is not a photograph of a neat rack. Useful evidence states what was checked, against which criteria, by whom, on what date, and what happened to the items that failed. For an identification control that usually means four artifacts: the defined population with its extraction date, the sample selection method, the per-item observation record, and the exception log with closure approvals.
Photographs support an observation record; they do not replace it. A photograph proves a label existed at one moment. It does not prove the identifier reached the record, that the object was in the population, or that anyone reconciled the difference. Pair images with the observation row they belong to, and name the object in a way a reader can trace.
Prefer evidence generated by the work itself over evidence assembled for the assessor. A review record produced at the time of a change, in the system that already tracks that change, is more credible and much cheaper than a reconstruction assembled the week before fieldwork.
Make the sample selection reproducible#
Write down how items were chosen. Random selection with a stated seed or method, every nth item from an ordered export, or full-population testing are all defensible; an unexplained list of twenty cabinets is not. If the assessor selects the sample, record their selection alongside your own population definition so both can be compared later.
Keep sample size decisions with the control owner rather than with the person doing the walking. The person performing the observation should be able to state the method without having designed it, which is what makes an independent repetition possible.
Worked fictional case: the exception log is the useful artifact#
In fictional DC01 / H1, the control under test is inventory completeness for equipment in two rows. The population is an inventory export of 412 devices taken on the first of the month. A reconciliation walk finds 404 devices matching a record, five devices present with no record, and three records with no device.
The five unrecorded devices are spares installed during a capacity change whose closeout was never completed; they are added, with the change reference and the date, and the change process is flagged as the cause. Two of the three missing devices are traced to a disposal batch whose documentation exists but was never linked to the inventory; the link is made and retained. One record cannot be resolved during the review and remains open, with an owner and a target date.
The evidence pack contains the export with its date and query, the reconciliation record, photographs attached to specific rows, and the exception log with three closures and one open item. The open item is not a failure of the evidence. An assessment can accept a known, owned, dated exception far more readily than it can accept a population that quietly balanced. Every number here is fictional.
Handle exceptions without rewriting history#
Resist the urge to correct the physical world and the record simultaneously and then present the result as if nothing was wrong. The reconciliation record should show the state at observation, the action taken, who approved it, and when. That sequence is the control operating. A clean sheet with no exceptions and no history invites the question of what was checked at all.
Where a discrepancy reveals a process cause, record the cause separately from the item. Eight unrecorded devices from one change window is a change-closeout problem, not eight labeling problems, and the corrective action belongs at the process level.
Keep the retention period in mind. Evidence that supports a control must survive until the assessment that tests it, which is often a year or more after the walk. Store it where retention is managed rather than in a personal folder or a chat thread.
Acceptance checklist#
Frequently asked questions#
Does labeling satisfy an inventory control?#
No. Labeling supports it. A control about inventory completeness and accuracy is satisfied by a maintained record with ownership and a process that keeps it current. Identification is what makes the physical verification of that record possible, and the reconciliation evidence is usually what an assessor actually examines.
Which framework should we map to first?#
Map to the one you are actually assessed against this year, in the version named in the engagement. Organizations facing several assessments usually find that one well-built population, reconciliation, and exception artifact serves multiple control families, because the underlying question is the same even when the numbering differs.
Is a photograph enough evidence?#
Rarely on its own. Pair every image with the observation row it supports, naming the object and the date. Photographs are strong corroboration for a condition and weak evidence of a process. An assessor testing whether a control operates is usually more interested in the exception log than in the pictures.
Should open exceptions be closed before the assessor arrives?#
Close what can be legitimately closed and leave the rest open with an owner and a date. Rushed closures without evidence are more damaging than a small number of tracked open items, because they suggest the record is managed for appearance. A known exception demonstrates that detection works.
How large should the sample be?#
That decision belongs to the control owner and often to the assessor, and it depends on population size, risk, and whether the control is preventive or detective. Record whatever was decided and why. The reproducible method matters more to the evidence than the specific number.
Can we reuse last year's evidence pack?#
Reuse the structure, never the observations. Each period needs its own population extraction, walk, and exception log with current dates. Keeping the format stable is genuinely valuable, because it makes year-over-year comparison possible and reduces the effort of each cycle.
Put the decision into a record
EDITABLE PLANNING DOCUMENT
Labeling evidence pack for an audit or assessment
Define the population, record two-way reconciliation, and keep a dated exception log that another reviewer can repeat.
Sources and applicability
- ISO: ISO/IEC 27001 catalogue entry ↗
Publisher catalogue page establishing the standard's identity and current status. Annex A control text is in the purchased document; the mapping in this guide is editorial and is not an interpretation of any control.
Read scope and linked guides - NIST: SP 800-53 Revision 5 control catalog ↗
Official publication page for the security and privacy control catalog, including the configuration management and physical protection families referenced in the mapping table.
Read scope and linked guides - PCI Security Standards Council: document library ↗
Official library for the current PCI DSS version and supporting documents. Cited so readers retrieve the applicable version rather than relying on a summarized requirement.
Read scope and linked guides - AICPA: 2017 Trust Services Criteria with revised points of focus ↗
Official source for the criteria used in SOC 2 examinations. Referenced for the existence and location of the criteria, not as an assurance opinion or a statement that any control is met.
Read scope and linked guides - Sunbird: Asset audit application note ↗
Vendor application note describing scan-based audit workflow. Used for workflow context; it is not a control interpretation and applies to the vendor's own product.
Read scope and linked guides