Collecting Compliance Evidence

What Counts as Evidence?

Evidence is anything that demonstrates a control is actually being followed — not just documented, but operating in practice. Auditors trust configuration screenshots, exported logs, and signed records far more than a policy statement alone. You don't need to wait until an audit is scheduled to start collecting it; the best evidence is gathered as you go, close to when the control activity actually happened.

Good First Pieces of Evidence

• MFA enforcement screenshot — a screenshot from your identity provider showing multi-factor authentication is required for all users.
• Backup configuration — an export showing your backup schedule, retention period, and a recent successful backup run.
• Access review record — a spreadsheet or export from your last user access review, showing who has access to what and that it was checked.
• Policy acknowledgement — evidence that staff have read and accepted a policy (e.g. the Acceptable Use Policy), such as a signed register or e-signature export.
• Security training completion — a report showing which staff have completed security awareness training and when.

Uploading and Organising

Click Add Evidence, drag your file in (up to 25 MB), and give it a clear title and description explaining what it demonstrates and when it was collected. Where relevant, map the evidence to the Annex A control(s) it supports — this is what lets you pull together a complete evidence pack for a specific control in seconds during an audit, instead of searching through folders.

A good habit: whenever you complete a recurring control activity (a quarterly access review, a DR test, a policy sign-off round), upload the evidence immediately rather than trying to reconstruct it later. See Evidence Collection for file integrity checks, encrypted storage, and the full metadata schema.