Question 1

What types of evidence do compliance frameworks require?

Accepted Answer

Compliance frameworks require evidence that demonstrates controls are designed appropriately and operating effectively. The types of evidence vary based on the control being verified, but generally fall into categories that auditors evaluate to assess compliance: configuration evidence, operational evidence, policy documentation, and attestations. Configuration evidence demonstrates that systems are set up correctly. This includes screenshots or exports showing access control settings, encryption configurations, firewall rules, logging enablement, and security features. Configuration evidence typically verifies that controls are properly designed and implemented at a technical level. Operational evidence demonstrates that controls are functioning over time. This includes access logs showing authentication events, change management tickets documenting approved changes, vulnerability scan reports showing remediation, incident tickets demonstrating response procedures, and audit logs showing system activity. Operational evidence is particularly important for SOC 2 Type II and ongoing compliance. Policy and procedural documentation demonstrates governance and intent. This includes information security policies, acceptable use policies, incident response plans, business continuity plans, and standard operating procedures. Auditors review these documents to understand the control environment and verify that documented procedures match actual practices. Attestations and acknowledgements demonstrate human compliance activities. This includes policy acknowledgement records, security awareness training completions, background check confirmations, access review approvals, and management sign-offs. These attestations link people to control activities and demonstrate that required human-in-the-loop processes are occurring. Different frameworks emphasise different evidence types. ISO 27001 focuses heavily on documentation and the ISMS lifecycle. SOC 2 Type II requires operational evidence over the audit period. GDPR emphasises processing records and consent documentation. Understanding framework-specific expectations helps organisations prepare appropriate evidence.

Question 2

How long should compliance evidence be retained?

Accepted Answer

Evidence retention periods depend on regulatory requirements, framework expectations, audit cycles, and organisational policies. While specific requirements vary, most organisations should plan to retain compliance evidence for at least one to three years, with longer retention for certain categories of evidence or when specific regulations mandate extended periods. SOC 2 audits typically examine a three to twelve-month observation period, so evidence from that period must be available for audit. However, auditors may request historical evidence to understand trends or verify remediation of prior issues. Retaining at least one year of evidence beyond the current audit period is prudent. ISO 27001 requires organisations to maintain documented information and records of ISMS operation. While the standard does not specify exact retention periods, the three-year certification cycle and annual surveillance audits suggest retaining evidence for at least three years to support the full certification lifecycle. Regulatory frameworks often specify retention requirements. GDPR requires retention of processing records for the duration of processing activities. HIPAA requires retention of policies and procedures for six years. DORA mandates retention of records on ICT-related incidents and testing results for at least five years. These specific requirements take precedence over general guidance. Beyond minimum requirements, organisations should consider litigation holds, contractual obligations, and the value of historical evidence for demonstrating continuous compliance. Automated evidence collection and retention through compliance platforms simplifies long-term storage and retrieval without manual effort.

Question 3

What is evidence freshness and why does it matter?

Accepted Answer

Evidence freshness refers to how current and relevant collected evidence is at the time of an audit or compliance review. Fresh evidence demonstrates that controls are currently operating as intended, while stale evidence may not reflect the current state of the control environment. Auditors place significant weight on evidence freshness when evaluating compliance. For SOC 2 Type II audits, evidence must demonstrate control operation throughout the observation period, with recent evidence confirming controls are still effective at the audit date. Evidence collected months ago at the start of the period is necessary but insufficient—auditors need to see that controls continued to operate until the end of the period. ISO 27001 surveillance audits expect to see recent evidence of ISMS operation. If the last management review was eighteen months ago or access reviews haven't been conducted since the initial certification, auditors will question whether the ISMS is actively maintained. Fresh evidence demonstrates ongoing commitment to continuous improvement. Stale evidence creates compliance risk. Configurations may have changed since the evidence was collected. Personnel may have joined or left the organisation. New systems may have been deployed without corresponding controls. Evidence that was accurate when collected may no longer reflect reality, potentially masking compliance gaps. Continuous evidence collection addresses freshness concerns by automatically gathering current evidence from connected systems. Rather than collecting evidence once before an audit, continuous monitoring ensures evidence is always recent. This approach reduces audit preparation effort while improving evidence quality and reliability.

Question 4

How do I organise evidence for multiple frameworks?

Accepted Answer

Organising evidence for multiple frameworks requires a centralised, control-centric approach that avoids duplication while maintaining clear traceability to specific framework requirements. The goal is to collect evidence once and apply it across all applicable frameworks, rather than maintaining separate evidence repositories for each certification. A control-centric structure organises evidence by control rather than by framework. Each control in the Unified Control Library has associated evidence requirements, and collected evidence is linked to the control. Framework mappings then connect controls to specific requirements, automatically associating evidence with all applicable frameworks. Clear naming conventions and metadata improve evidence organisation. Evidence should include information about what was captured, when it was collected, which system or process it relates to, who collected it, and any relevant context. This metadata enables efficient searching, filtering, and presentation during audits. Version control ensures evidence integrity and supports historical review. When policies are updated, configurations change, or evidence is refreshed, previous versions should be preserved with clear timestamps. This supports audit trails and enables comparison of control states over time. Audit-ready packaging prepares evidence for specific engagements. While evidence is stored centrally, generating audit packages that organise evidence according to specific framework structures (ISO 27001 Annex A controls, SOC 2 Trust Service Criteria, etc.) helps auditors navigate the evidence efficiently. Modern compliance platforms generate these packages automatically.

Question 5

What is the difference between automated and manual evidence?

Accepted Answer

Automated evidence is collected directly from systems through integrations, APIs, or agents without human intervention, while manual evidence requires human action to gather, create, or upload. Both types are valid for compliance purposes, but they differ significantly in reliability, freshness, and the effort required to maintain them. Automated evidence includes system configurations pulled from cloud providers, access logs exported from identity systems, vulnerability scan results from security tools, encryption status verified through APIs, and patch levels reported by endpoint management systems. This evidence is typically more reliable because it comes directly from the source without human transcription errors. Manual evidence includes policy documents uploaded by administrators, screenshots captured from systems without API access, attestation forms completed by employees, meeting minutes documenting reviews, and exception approval records. While necessary for many controls, manual evidence requires human effort and is subject to delays, errors, and inconsistent collection. The reliability difference matters to auditors. Automated evidence from authoritative sources provides higher assurance because it cannot be easily modified or fabricated. Manual evidence, particularly screenshots, may require additional verification to confirm authenticity and accuracy. Auditors generally prefer automated evidence when available. Organisations should prioritise automating evidence collection for controls where integrations are available. This reduces ongoing effort, improves evidence freshness, and increases reliability. Manual evidence should be reserved for controls that genuinely require human input or where system integrations are not feasible. The trend in compliance is toward increasing automation of evidence collection.

Frequently Asked Questions

Evidence Management

Still have questions?