Evidence

What the screen is for#

The "Evidence repository" gathers all the evidence attached to action-plan tasks, with their ISO 27001 and SOC 2 requirements. Evidence is a reference (a name and, if there is one, an https:// address) or an attached file. The screen is used to find it, check coverage, and add some quickly.

Who can do what#

Step by step#

Find evidence#

1. Read the tiles: "Evidence recorded", "Tasks documented", "With an address", "Controls with references".
2. Search by name, task, requirement or address. Filter by "Type of evidence" and by "Task concerned".
3. The table gives the "Evidence", its "Type", the "Task & requirements", "Added by" and the "Date". Click the address to open it, or "Download" for a file.

Add evidence#

1. Under "Add evidence to a task", choose the "Target task". With no task, run the assessment first.
2. Choose the "Type": "Document", "Link", "Screenshot", "Report", "Attestation", "Ticket" or "Other".
3. Enter the "Name of the evidence (required)" and, if you wish, the "Adresse (facultative)" in https://.
4. Attach a file if needed: 25 MB at most (PDF, images, Word, Excel, PowerPoint, CSV, text, ZIP).
5. Click "Add the evidence". A message says "Evidence recorded" or "This evidence was already recorded".

The detail of files and frozen Jira queries is in Action plan.

What the auditor will take from it#

For each piece of evidence: name, type, author, date, task and requirements covered. For a file: its name, size and SHA-256 fingerprint. The preuves.csv file of the audit pack lists them. The files themselves are not in the pack: they are downloaded in the app.

Known limits#

• Evidence cannot yet be removed, and a task carries 100 at most.
• If the evidence of some tasks could not be read, the screen warns that the list and the figures are incomplete.
• The app does not check that an address responds: it only checks that it is https://, with no space or credentials.
• A file uploaded but never attached to evidence is cleaned up after 24 hours.