Question 1

What types of evidence do compliance frameworks require?

Accepted Answer

Compliance frameworks require evidence that demonstrates controls are appropriately designed and operating effectively. The types of evidence vary depending on the control being verified, but typically fall into categories that auditors evaluate to assess compliance: configuration evidence, operational evidence, policy documentation and attestations. Configuration evidence demonstrates that systems are set up correctly. This includes screenshots or exports showing access control settings, encryption configurations, firewall rules, logging enablement and security features. Configuration evidence typically verifies that controls are properly designed and implemented at the technical level. Operational evidence demonstrates that controls function over time. This includes access logs showing authentication events, change management tickets documenting approved changes, vulnerability scan reports showing remediation, incident tickets demonstrating response procedures and audit logs showing system activity. Operational evidence is particularly important for SOC 2 Type II and continuous compliance. Policy and procedure documentation demonstrates governance and intent. This includes information security policies, acceptable use policies, incident response plans, business continuity plans and standard procedures. Auditors review these documents to understand the control environment and verify that documented procedures align with actual practices. Attestations and confirmations demonstrate human compliance activities. This includes policy acknowledgement statements, security awareness training completions, background check verifications, access review approvals and management sign-offs. These attestations link individuals to control activities and demonstrate that required human-in-the-loop processes take place. Different frameworks emphasise different evidence types. ISO 27001 focuses heavily on documentation and the ISMS lifecycle. SOC 2 Type II requires operational evidence across the audit period. GDPR emphasises processing records and consent documentation. Understanding framework-specific expectations helps organisations prepare appropriate evidence.

Question 2

How long should compliance evidence be retained?

Accepted Answer

Evidence retention periods depend on regulatory requirements, framework expectations, audit cycles and organisational policies. While specific requirements vary, most organisations should plan to retain compliance evidence for at least one to three years, with longer retention for certain evidence categories or when specific regulations mandate longer periods. SOC 2 audits typically examine an observation period of three to twelve months, so evidence from that period must be available for audit. However, auditors may request historical evidence to understand trends or verify remediation of prior issues. Retaining at least one year of evidence beyond the current audit period is prudent. ISO 27001 requires organisations to retain documented information and records of ISMS operation. While the standard does not specify exact retention periods, the three-year certification cycle and annual surveillance audits suggest that evidence should be retained for at least three years to support the full certification lifecycle. Regulatory frameworks often specify retention requirements. GDPR requires retention of processing records for the duration of processing activities. HIPAA requires retention of policies and procedures for six years. DORA mandates retention of records of ICT-related incidents and test results for at least five years. These specific requirements take precedence over general guidance. Beyond minimum requirements, organisations should consider litigation, contractual obligations and the value of historical evidence for demonstrating ongoing compliance. Automated evidence collection and retention through compliance platforms simplifies long-term storage and retrieval without manual effort.

Question 3

What is evidence freshness and why does it matter?

Accepted Answer

Evidence freshness refers to how current and relevant collected evidence is at the time of an audit or compliance assessment. Fresh evidence demonstrates that controls are currently working as intended, while stale evidence may not reflect the current state of the control environment. Auditors pay considerable attention to evidence freshness when evaluating compliance. For SOC 2 Type II audits, evidence must demonstrate control operation across the observation period, with recent evidence confirming that controls are still effective on the audit date. Evidence collected months ago at the start of the period is necessary but insufficient — auditors need to see that controls continued working up to the end of the period. ISO 27001 surveillance audits expect to see recent evidence of ISMS operation. If the last management review was eighteen months ago or access reviews have not been performed since initial certification, auditors will question whether the ISMS is being actively maintained. Fresh evidence demonstrates ongoing commitment to continual improvement. Stale evidence creates compliance risk. Configurations may have changed since the evidence was collected. Personnel may have joined or left the organisation. New systems may have been deployed without corresponding controls. Evidence that was accurate at collection may no longer reflect reality, potentially concealing compliance gaps. Continuous evidence collection addresses freshness issues by automatically collecting current evidence from connected systems. Rather than collecting evidence once for an audit, continuous monitoring ensures that evidence is always recent. This approach reduces audit preparation effort while improving evidence quality and reliability.

Question 4

How do I organise evidence for multiple frameworks?

Accepted Answer

Organising evidence for multiple frameworks requires a centralised, control-centred approach that avoids duplication while maintaining clear traceability to specific framework requirements. The goal is to collect evidence once and apply it across all applicable frameworks, rather than maintaining separate evidence repositories for each certification. A control-centred structure organises evidence by control rather than by framework. Each control in the Unified Control Library has associated evidence requirements, and collected evidence is linked to the control. Framework mappings then connect controls to specific requirements, automatically associating evidence with all applicable frameworks. Clear naming conventions and metadata improve evidence organisation. Evidence should contain information about what was captured, when it was collected, which system or process it relates to, who collected it and any relevant context. This metadata enables efficient searching, filtering and presentation during audits. Version control ensures evidence integrity and supports historical review. When policies are updated, configurations change or evidence is refreshed, previous versions should be retained with clear timestamps. This supports audit trails and enables comparison of control states over time. Audit-ready packaging prepares evidence for specific engagements. While evidence is stored centrally, generating audit packages that organise evidence according to specific framework structures (ISO 27001 Annex A controls, SOC 2 Trust Service Criteria, etc.) helps auditors efficiently navigate the evidence. Modern compliance platforms generate these packages automatically.

Question 5

What is the difference between automated and manual evidence?

Accepted Answer

Automated evidence is collected directly from systems through integrations, APIs or agents without human intervention, while manual evidence requires human action to collect, create or upload. Both types are valid for compliance purposes, but they differ significantly in reliability, freshness and the effort required to maintain them. Automated evidence includes system configurations retrieved from cloud providers, access logs exported from identity systems, security scan reports from security tools, encryption status verified through APIs and patch levels reported by endpoint management systems. This evidence is typically more reliable because it comes directly from the source without human transcription errors. Manual evidence includes policy documents uploaded by administrators, screenshots captured from systems without API access, attestation forms completed by employees, meeting notes documenting reviews and exception approval records. While necessary for many controls, manual evidence requires human effort and is subject to delays, errors and inconsistent collection. The reliability difference matters to auditors. Automated evidence from authoritative sources provides higher assurance because it cannot easily be altered or fabricated. Manual evidence, particularly screenshots, may require additional verification to confirm authenticity and accuracy. Auditors generally prefer automated evidence where available. Organisations should automate evidence collection for controls where integrations are available. This reduces ongoing effort, improves evidence freshness and increases reliability. Manual evidence should be reserved for controls that genuinely require human intervention or where system integrations are not feasible. The trend in compliance is towards increased automation of evidence collection.

Frequently Asked
Questions

Evidence Management

Still have questions?

Frequently AskedQuestions