Answer

What evidence should I keep for ISO 18033-7?

Six artefacts: the inventory row, the key and tweak lengths, the tweak policy, the known-answer test, the supplier declaration and the dated decision record. Each has an owner and a retention line in the kit.

The six artefacts

The inventory row names the algorithm, the block length, the key length, the tweak length and the standard version. The key and tweak lengths prove the 128-bit floor and the split. The tweak policy says what the tweak is and who may see it. The known-answer test ties the implementation to Annex A. The supplier declaration covers any third-party module. The decision record says what you concluded and when you will look again.

What an auditor will not accept

A statement that the product uses strong cryptography, a library name without a version, a round trip on your own data, or a link to the standard without a clause. These are claims, not evidence. The record lists the difference on every unit page.

Retention

Keep the evidence for the life of the product plus the retention period your ISMS sets for design records. When the amendment publishes, add the new text and the comparison to the file rather than replacing the old one.

Check it yourself

The record is on the publication page. The base text is mapped on the contents page. The free check turns the answer into a dated decision record.

Not legal advice; does not certify.