Evidence management

The problem it solves

Evidence usually lives in shared drives, ticket attachments and email threads. During an assessment it is gathered again from scratch, and nobody can prove when a screenshot was taken or which control it was meant to support.

How it works

1. 1

   Collect with context

   Evidence is uploaded with the metadata that makes it usable later: what it shows, the period it covers, where it came from and who provided it.

2. 2

   Map to controls

   Each item is mapped to the controls it supports. One well-chosen artefact can satisfy requirements in several frameworks at once, and the mapping shows exactly where it is relied upon.

   • Manual upload with structured metadata — available now
   • GitHub evidence connector — available now
   • Additional connectors — see the integrations page for status
3. 3

   Review before it counts

   A reviewer validates the item against the control expectation. Until that review happens the evidence is held but not treated as satisfying anything.

4. 4

   Keep it current

   Evidence carries a freshness expectation. Items that age out are flagged so a period-of-time assessment does not fail on stale artefacts.

Capabilities

What people remain responsible for

• Validating that evidence actually demonstrates the control
• Deciding when evidence must be refreshed
• Approving what may be shared with an auditor or customer