Evidence shows that your security measures really work: a signed policy, a backup test record, an ISO certificate or a penetration test report. Customers and auditors often ask for it.
How to add evidence
- Open Evidence in the menu, then Add evidence.
- Give the Evidence a short name, add a Description and choose the Type (Document, Record, Certificate, Report, Screenshot or Other) and the Owner.
- Link it to the Control it supports or the Incident it documents.
- If it expires, for example a certificate, set Valid until. Leave it empty if it does not expire.
- Optionally add a Web address starting with https:// and choose a file.
- Click Save evidence. It gets a number such as E-12.
Files
- You can upload PDF, Word, Excel, PowerPoint, images, text or CSV files of up to 25 MB.
- Files are kept in private storage. Only people who can see the evidence can download them.
- On the evidence page, use Add file, Replace file, Remove file or Download.
Expiry and reminders
Each item shows its validity: Valid, Expiring soon, Expired or No expiry date. The owners, admins and the evidence's owner get a reminder 30 days before the Valid until date and on the day. Expiring evidence also appears in Tasks as Evidence expires. When you renew it, set the new date and replace the file; the next expiry is reminded again.
What members can do
Members see evidence and can add it. They can also manage the file of evidence they added themselves. Changing and deleting evidence needs an owner or admin (or a custom role with that permission).
Tips
- Sort by Expires first to see what needs renewing soon.
- The page of a control or incident lists the evidence linked to it.
- Deleting evidence also deletes its file; the history stays in the audit log.
- Package limits: Free 25 evidence items, Supplier 100, Professional and higher unlimited.