In an ICO investigation or ISO 27001 audit, you must prove not just what controls you had, but when they were operating.

Running vulnerability scans, penetration tests, and patch management cycles as required by ISO 27001:2022 Annex A 8.8 and your security policy.

Timestamp each vulnerability scan report and patch deployment record at the moment it is completed. When the ICO or a customer asks whether a known vulnerability was remediated before a breach occurred, the blockchain record proves the timeline independently of your internal systems, which are controlled by your own administrators.

Advanced Computer Software Group Ltd was fined £3.07M (ICO, March 2025) because it could not demonstrate that vulnerability scanning was deployed across all its systems. The ICO found gaps in MFA deployment and inadequate patch management. The company was a processor for the NHS. The question was not whether controls existed, but whether they were operating at the time of the 2022 attack.

Raising and approving change requests before deploying to production, including change advisory board approvals and rollback plans.

Timestamp each change request and approval at the moment it is signed off. In an incident investigation or SOC 2 audit, the blockchain record proves that changes were approved before they were deployed, not that approval records were created retrospectively after a change caused an outage or security incident.

SOC 2 Type II certification requires evidence that change management controls were operating continuously throughout the audit period, not just at the point of the audit. A change record that cannot prove it was raised before the deployment is a direct route to a qualified opinion or failed certification.

Conducting code reviews, security testing, and pre-release security assessments as part of the secure development lifecycle.

Timestamp each security review and sign-off at the moment of completion. If a customer suffers a data breach caused by a vulnerability in your product, the blockchain record proves the security review was conducted and completed before the product was released, not compiled retrospectively when the claim arrived.

Under UK GDPR, a data processor who deploys software containing a known or foreseeable vulnerability faces joint liability with the controller for any resulting breach. Independent timestamps of pre-release security reviews are the primary evidence that due diligence was exercised at the relevant time.

Conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities before they begin, as required by UK GDPR Article 35.

Timestamp each DPIA at the moment it is completed and approved. UK GDPR Article 35 requires a DPIA to be carried out before the processing commences. An independent timestamp proves the DPIA was completed contemporaneously, not backdated after an ICO inquiry opened.

Capita plc was fined £14M (ICO, October 2025) after a 2023 ransomware breach affecting 6.6 million people. A P2 alert was generated within minutes of the malicious download, but effective isolation took 58 hours, far outside Capita's own one-hour SLA. The investigation found repeated audit findings that were not remediated across all business units.

Conducting periodic access rights reviews to ensure least-privilege principles are maintained, as required by ISO 27001:2022 Annex A 5.18.

Timestamp each access review at the moment it is completed. In an ISO 27001 audit or ICO investigation, the blockchain record proves reviews were conducted at the scheduled interval, not rushed through when an audit was announced or a breach investigation began.

ISO 27001 requires access reviews to be conducted at planned intervals with documented evidence. Reviews that cannot prove they were conducted when they were supposed to be are a major nonconformity. Loss of ISO 27001 certification can trigger contractual clauses and procurement disqualification in regulated sectors.

Logging security events and incidents in real time as required by ISO 27001:2022 Annex A 8.15 and NIS2 Article 23 notification requirements.

Timestamp each incident log entry at the moment it is created. NIS2 Article 23 requires notification within 24 hours of awareness of a significant incident. An independent timestamp of the initial log entry proves awareness at a specific time, satisfying the regulatory notification requirement without relying on system clocks that could be questioned.

NIS2 Directive requires incident notification within 24 hours of awareness, with full report within 72 hours. A company that cannot prove the precise time it first became aware of an incident, and that its notification was sent within the required window, faces penalties up to €10M or 2% of global turnover.

Conducting information security risk assessments before deploying new systems or making significant changes to existing ones.

Timestamp each risk assessment at the moment it is completed and approved. In an ICO investigation or ISO 27001 audit, the blockchain record proves the risk assessment was conducted before the system went live, not created after a breach to show that appropriate consideration was given.

Interserve Group Ltd was fined £4.4M (ICO, October 2022) after a phishing attack. The ICO found that Interserve had failed to keep its software up to date and had failed to implement adequate security training. A common pattern in ICO enforcement is the finding that risk assessments were inadequate or not in place at the relevant time.

Assessing the security posture of third-party suppliers and cloud service providers before onboarding them, as required by ISO 27001:2022 Annex A 5.19.

Timestamp each supplier security assessment at the moment it is completed. In a data breach caused by a third-party supplier, the blockchain record proves the assessment was conducted before the supplier was onboarded, not completed retrospectively to satisfy a post-breach investigation.

Under UK GDPR, a controller remains liable for breaches caused by a processor who was inadequately assessed at onboarding. Third-party breaches account for a significant proportion of ICO enforcement cases. A contemporaneous supplier security assessment is the primary defence against controller liability in a processor-caused breach.