Evidence Request Lists
Evidence collection is the bottleneck of any audit. We publish our core request lists openly so you know exactly what will be asked of your team before you sign a contract.
Scoped to team size
A twelve-person engineering team does not need the same evidence artifacts as a two-hundred-person enterprise. Our auditors scale the evidence request based on your headcount and complexity, focusing on whether the control objective is met, not whether you used a specific enterprise tool.
SOC 2 (Security)
Standard artifact requests covering the Common Criteria (CC1-CC9).
- • Organizational chart
- • Information Security Policy
- • Access control list exports
- • Background check samples
- • Vulnerability scan reports
ISO/IEC 27001
Management system documentation and Annex A control evidence.
- • Statement of Applicability (SoA)
- • Risk Assessment Methodology
- • Risk Treatment Plan
- • Internal Audit results
- • Management Review minutes
Need help generating evidence?
Get an exact
figure.
Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.
Request a quote ↗