Evidence

For a long time, the answer to "how does your company handle security" was a policy document. Departing employees lose account access on their last day; production database access requires two approvals. Send over a file with sentences like those in it and the question was considered answered.

The trouble is that a policy says only what a company decided to do. Whether it happened is a separate question. When Sofia at Pagedeck got a security questionnaire from an enterprise prospect, Grace answered that departing employees are locked out immediately, and the other side replied asking for a list showing when each person who left in the past year lost access. Nothing in the company could close the gap between the decision and the doing.

Evidence is the record that started being demanded to close that gap. Instead of a statement or a commitment, it pulls out the trace the system left at the moment the thing happened. Companies that fall behind on compliance usually aren't missing rules — they're missing traces of following them. Writing the rule takes a week; assembling proof that it was followed takes six months.

A single piece of evidence needs five things attached to it before an auditor will accept it.

1. What it is evidence of — which control it attaches to. A control is one specific management measure defined to reduce one risk, and evidence always aims at one of them. A record attached to nothing doesn't get read during an audit.
2. What period it covers — a point in time and a span of time are different things. A firewall configuration screenshot speaks only for the instant it was taken. Showing that access reviews happened quarterly across twelve months requires four records, each timestamped inside its own quarter.
3. Who did it — the person who acted and the person who approved. For a control requiring two approvals, two approver names have to appear under two separate accounts. A record where the same person requested and approved is evidence that the control was not followed.
4. Where it came from — which system produced it, who exported it, and when. Running the same query under the same conditions has to return the same result, so the auditor can reproduce it on the spot.
5. That nobody edited it — the format has to be one the exporter couldn't alter. Copy a list into a spreadsheet to tidy it up and it stops being the original and becomes a transcription, which audits treat as one step weaker.

The same fact carries different weight depending on its form. A record the system wrote automatically beats a table a person typed up, and a query that returns the same values whenever it runs beats a screenshot captured at some moment. A screenshot needs the person who took it to explain which screen and which filter it shows, which puts a human statement back into the one place built to remove it.

Evidence isn't a document somebody sits down to write. It's what work leaves behind, which means it comes from the people doing that work rather than from one security owner. Offboarding evidence accumulates wherever people operations happens; database approval evidence accumulates in engineering. The security owner's job is to set the tools up so the records land, and to gather them at audit time — not to write them on anyone's behalf.

Four audiences read them.

1. Internal audit — the company running the check on itself first. An audit is the procedure for confirming that operations match what was defined, and running it internally first exists to surface the controls with empty evidence before an external auditor finds them.
2. External auditors — a qualified third party working through a criteria list and asking for evidence item by item. In an examination like SOC 2, which looks at whether controls actually held over six to twelve months, what gets checked is whether records are spread evenly across that whole window.
3. Customer security teams — reviewing before a contract closes. Sometimes a certificate settles it, but a deal moving a lot of data usually brings requests for evidence per control. In the other direction, when Pagedeck adopts a new external tool, the same questions go downward under the name vendor assessment.
4. Regulators and customers after an incident — the audience that looks at nothing for years and then at everything at once. What they need is a record that the control was running at the time of the incident, which is exactly the record that can't be created afterwards.

"That's the policy document. The evidence has to exist separately."

A written rule on its own doesn't confirm that anything was done.

"Can you pull the Q3 access review evidence?"

A request for the record showing permissions were reviewed that quarter, to submit as audit material.

"Send the list straight out of the system, not a screenshot."

Asking for a form that passed through fewer human hands, because that's what the audit will accept.

When Pagedeck started preparing for ISO 27001, the first move wasn't writing new rules. It was checking whether the things already being done left records. Departing employees had always been locked out, but nothing captured who did it or when, so the offboarding step in the people tool and the account suspension were rewired to land on one screen together.

Assuming this can be assembled right before the audit is the most common mistake. Most other submissions do get made that way, and since the rules are already being followed, tidying up records looks like the only remaining work. But evidence covering a period cannot be created retroactively. If a control that should have been reviewed quarterly shows four records all stamped a month before the audit, that isn't evidence the reviews happened — it's evidence they didn't. Backfilled material rarely stays contained either; it usually gets the auditor looking harder at every other control's records too.

Reading evidence collection as paperwork is the other frequent mistake. The deliverables arrive as files, so it looks like something a person produces by sitting down and producing it. The actual work is making records land rather than writing them. It means moving approvals out of chat threads and into a tool that keeps an approval history, and turning a permission review from a calendar entry into a process that stores its result. Push in that direction and audit time becomes one query. Push in the writing direction and the next audit costs exactly as much again.