Ask an auditor what slows an audit down and you'll hear about evidence that can't be trusted on sight.
A screenshot of an AWS console. A CSV someone exported "around March." A PDF of a settings page with no URL bar. Every one of those starts a conversation: when was this taken, from which account, and has anyone touched it since?
None of those questions are unreasonable. They're just expensive to answer after the fact.
What good evidence looks like
Good evidence answers three questions without anyone having to vouch for it:
- Where did it come from? Which system, which account, which region.
- When was it collected? A timestamp set by the system that collected it, not typed by a person.
- Is it the same thing that was collected? Something that shows the content hasn't changed since.
Screenshots fail all three. Manual exports usually fail the third.
How Safeguard now handles it
When Safeguard tests a connected system, the snapshot now captures evidence for every tested connection and account, and stores a hash of the response it received.
That hash is the part that matters. If anyone edits the stored evidence later, the hash no longer matches. Nobody has to argue about whether a file was touched. The math settles it.
A few related changes make the trail easier to follow:
- Every result names its source. Cloud test results show the account and region they were read from.
- Automated evidence is labeled as automated. The Safeguard connection is named as the evidence account and badged, so a reviewer can tell machine-collected evidence from uploaded files at a glance.
- When an API can't answer, a person does, on the record. Some controls can't be read from an API at all. For those, evidence comes through a reviewed attestation instead of a blank.
What this changes in an audit
The auditor's sample request stops being a scavenger hunt. You hand over evidence that already carries its origin, its timestamp and a way to check it's intact.
It also changes who does the work. Evidence that collects itself, with a hash attached, doesn't need an engineer to rerun a query and take a new screenshot every quarter.
A short checklist for your own evidence
Whatever tool you use, it's worth asking of each evidence item:
- Could I tell which account this came from without asking someone?
- Is the timestamp machine-set?
- If this file were edited tomorrow, would anyone be able to tell?
If the answer to the last one is no, that's the gap auditors will eventually find.
Try it yourself
Click through it at your own pace, or open it full screen.
Take five evidence items from your last audit. For each one, answer the three checklist questions above. Score one point per yes. Under 10 out of 15 means auditors are trusting people, not evidence. See also SOC 2 evidence in minutes.
Quick check
What does a stored response hash prove?
That the evidence hasn't been edited since it was collected. If anyone changes it, the hash no longer matches.
How can a reviewer tell automated evidence from uploaded files?
The Safeguard connection is named as the evidence account and the evidence is badged as automated.
