Evidence
Three ways to prove a control, one field that decides when the proof goes stale, and a history that never loses the old version.
Evidence hangs off a control. There is a cross-control register at Compliance → Evidence for filtering and downloading, but you attach evidence from the control it proves.
Attach it
Section titled “Attach it”Open the control, go to its Evidence tab, and choose Attach evidence. The dialog has three tabs.
-
Upload — a file. Drag it in or browse. Give it a summary (the short label that appears in list views) and an effective date.
-
Attest — no file, a statement. “I attest that…”, signed by you, dated. Right for the things that have no artefact: a decision taken, a review held, a practice followed.
-
Automated — you do not use this tab. Automated evidence arrives from a control test, carrying the test output and the moment it ran.
The effective date is the important field
Section titled “The effective date is the important field”Expiry and the renewal reminder are both derived from it. Set it to when the evidence was actually true, not when you got round to uploading it — an access review run in March and uploaded in June is March evidence, and dating it June quietly buys you three months you do not have.
The register then reports each item as Current, Expiring soon, Expired or No expiry, and the control above it inherits that status.
Sensitive evidence
Section titled “Sensitive evidence”Mark as sensitive restricts download to the uploader, administrators and auditors. Use it for anything that would itself be an incident if it leaked — a penetration-test report with unfixed findings, an export containing personal data. The item stays visible in the register so nobody thinks it is missing; only the file is restricted.
Superseding, not replacing
Section titled “Superseding, not replacing”Attach a newer version and the previous one is superseded rather than deleted, and stays available under Superseded evidence. That is deliberate: “what proved this control in Q2” is a question audits ask, and an overwritten file cannot answer it.
Each item also carries its own audit trail — who uploaded it, who edited the metadata, when — and a SHA-256 hash of the file, which is what lets you prove the artefact has not changed since it was collected.
When AI has looked at it
Section titled “When AI has looked at it”An uploaded file may arrive with AI suggestions: a proposed classification, the controls it looks like evidence for, and anomalies such as a stale date or content that does not match the type claimed. Every suggestion sits in Awaiting review until a person applies or rejects it, and a rejection asks for a reason so the audit trail explains the decision. Nothing is attached to a control on the model’s say-so.