Evidence
Automated collection
Manual collection
?
Controls without current evidence. Ask the control owner for a screenshot, a process description or logs: the drafted message says what is needed and how it can be collected automatically next time.
Upload evidence
Choose the control the evidence supports, then add a file or a note.
All controls and their evidence
Audit calendar
?
The next twelve months: when evidence expires and must be renewed, evidence tasks fall due, roadmap milestones end and regulatory dates apply.
Audit plan
?
One swimlane per planned audit. The preparation is scheduled back from the audit date: connect evidence collectors, assign control owners, request manual evidence, the review meeting, review and send the audit bundle, then answer the auditors' questions and interviews.
Calendar
Alerts
?
Alerts are things in your evidence that need someone to act: drift (a control's evidence status got worse, for example from Passed to Missing), evidence that expires within 30 days, and evidence tasks past their due date. Acknowledge drift once it is handled; the others clear when new evidence arrives or the task is done.
Connectors
?
Collect evidence automatically from your identity, cloud, security and productivity tools. Read-only credentials are enough; they are stored encrypted and never shown again. Without a connection (air-gapped installations, or tools without an API connector), import the tool's own export file: it becomes the same evidence.
Add a connector or import an export
Audit bundle and export
?
The audit bundle holds the executive summary for the auditor, the control matrix, policies, evidence and the audit log. Limit it to one framework or certification for an audit of just that.