A security tool can support audit evidence if it exports dated, tamper-evident records of scans, policies, exceptions and approvals, and maps them to the controls in your framework. It cannot replace the audit itself. Ask what it exports, in which formats, and what stays your responsibility.
Definitions
Audit evidence is a record that shows a control operated, such as a scan result with a date, or a pull request showing an approval. A framework mapping links your tool's outputs to named controls in a standard such as SOC 2, ISO 27001 or the NIST secure software development framework. An attestation or report is something an independent auditor issues. A tool can help you collect evidence for it, but a tool cannot hand you the report.
Questions to ask
| Question | What a clear answer includes |
|---|---|
| Which frameworks does it map to? | A named list, with the control references shown |
| What exactly is exported? | Scan history, policy settings, exceptions, approvals, user access |
| In which format? | Machine readable and human readable |
| Is each record dated and attributable? | Actor, time, version of the policy |
| Can you reproduce a point in time? | "What was our policy on 1 March?" |
| How are exceptions evidenced? | Reason, owner, expiry |
| Who is responsible for the mapping being correct? | Be wary of "fully automated compliance" |
The last question is the honest one. Mappings are a convenience. Your auditor decides what counts, so ask whether a sample export has been reviewed with auditors you can talk to.
Common evidence gaps
Evidence tends to fail on three things. Records without dates, exceptions that never expire, and settings that cannot be shown as they were last quarter. Look for history, not just a current state. Our posts on what CI output can count as audit evidence and mapping claims to artifacts go further.
Steps to test in a trial
- Pick one control you must evidence, such as vulnerability management or change approval.
- Ask the vendor to produce the evidence for it from your trial data.
- Hand the export to someone who has sat through an audit and ask: would you accept this?
- Check that it includes who, what, when and the policy in force at the time.
- Try producing the same evidence for last month, to test history.
Be careful with wording in your own materials. Never describe a report as complete before the auditor issues it, and never imply that using a tool equals a certification.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a framework control and see which evidence supports it, then ask each vendor to show the same trail.
Quick check
Does a compliance tool make us compliant?
No. It helps collect and organise evidence. Compliance depends on your controls operating and an auditor's assessment.
Are screenshots acceptable evidence?
Sometimes, but dated exports and system generated records are stronger and easier to repeat.
Safeguard offers compliance and evidence automation as a GA capability; try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
