Evidence
Collect, attach and review evidence
Evidence is the proof behind a control. Without it a control is a claim, and readiness reflects that.
Kinds of evidence
- Uploaded files — policies, certificates, exported logs, screenshots.
- Written documents — authored in the built-in editor, versioned in place, useful when the evidence is the policy.
- Automated evidence — produced by an integration on a schedule rather than by a person remembering.
Evidence types
An evidence type describes what a control expects — an access review record, a penetration test report, a signed policy. Framework controls reference types rather than specific files, so one uploaded document can satisfy the same type across many controls.
Each reference is required, recommended or optional. Required types gate
the control: until one is attached and validated, the control cannot pass however
complete everything else is.
Lifecycle
Draft
Evidence starts as a draft while it is being written or collected. Drafts do not count towards readiness.
Attached
Attach it to a control or to an internal control. Attaching to an internal control propagates to every framework control mapped to it.
Reviewed
Someone other than the author confirms it says what the control needs. Required evidence has to clear this step.
Expired
Evidence carries a validity period. Once past it, the evidence goes stale and the
control it backed moves to at risk — which is the point: last year's access
review is not this year's.
Storage and access
Files live in private storage and are served through the platform, never from a public URL. A link to a piece of evidence works for people with access to the organization and for auditors within the scope of their engagement; it is not a public link that can be forwarded.
Keeping evidence fresh
The evidence that ages fastest is the evidence auditors care most about: access
reviews, backup restores, training records, penetration tests. Set realistic
validity periods when you attach them and let at risk do the reminding, rather
than discovering the gap the week before an audit.