Evidence is what turns "we do this" into "here's proof." The vault attaches files to the specific control they support, so at audit time nothing is hunted for in a shared drive.
Attaching evidence
On any control, choose Upload evidence and add the file(s) that prove it. The vault records:
- Versioning — upload a newer version and the history is kept, so you can show evidence current as of a given date.
- Who and when — each file is stamped with the uploader and timestamp.
How the vault protects your files
Evidence is sensitive, so the vault is built to a hostile threat model:
- Encrypted at rest with keys distinct from the rest of the portal (envelope encryption, per-tenant data keys).
- Isolated private storage — a dedicated bucket with its own credentials; no public objects.
- Signed, short-lived access — files are reachable only through temporary signed links, never a public URL, and are never executed or served from a location that could run them.
- Upload hardening — strict type and size limits, content sniffing, and malware scanning on every file.
- Tamper-evident audit — every read, upload, and delete is recorded in an append-only log.
See the full security & isolation model.
What evidence to collect
Auditors want to see that a control is both designed and operating. Good evidence usually falls into a few types:
- Policies & procedures — the written document (access control policy, incident response plan).
- Configurations — a screenshot or export showing the setting is enforced (MFA required, disk encryption on, logging enabled).
- Records of operation — proof the process actually ran (an access review from last quarter, a completed onboarding checklist, a resolved ticket).
- Tickets & logs — system-generated evidence that's hard to fake and easy to date.
Tip: Prefer evidence that carries its own date and is generated by a system (an export, a log, a ticket) over a hand-made document. Dated, system-generated evidence is the most credible and the least work to refresh next year.
Gathering configuration evidence by hand is the slow half of the work. If you'd rather it came from the systems themselves, automated evidence collection from your live tools reads control state directly from identity, endpoint, cloud, and backup systems.
For a control-by-control starting list, see the evidence checklist (also a downloadable PDF).