Automate the evidence that repeats often and already sits in a system with timestamps: pull request approvals, CI and scanner results, and user lists from your code host. Leave judgment items such as policy approval and risk reviews for later. Start with the sources that would hurt most to rebuild by hand.
What "automate evidence" means
Evidence is a record that a control operated. Automating it means a script or integration collects that record on a schedule, from the system that produced it, without someone taking a screenshot. The goal is not to remove people. It is to stop depending on memory when an auditor asks what happened in March.
The order that pays off fastest
| Order | Evidence stream | Why it goes early |
|---|---|---|
| 1 | Code review and merge records | High volume, one source, easy to pull |
| 2 | CI runs and scanner output | Expires on a retention clock |
| 3 | Member and role lists from the code host | Needed for every access review |
| 4 | Vulnerability alerts and their dispositions | Shows you act on findings |
| 5 | Deployment approvals | Ties a release to a reviewer |
| 6 | Policy, training and risk records | Low volume, mostly manual |
The ranking comes from two questions. How many times will the auditor sample this? And what happens if the record vanishes?
Why CI output is item two, not item five
Retention is the quiet risk. GitHub documents that checks, workflow runs, commit statuses, artifacts and logs are retained for 90 days by default, and that from 1 October 2026 the retention policy applies to checks, workflow runs and commit statuses too, where before they were kept for 400 plus days. If your audit window is six or twelve months, the raw run history may be gone before anyone asks. Copy what matters out of the system on a schedule. Our post on GitHub run retention and audit windows covers the details.
A simple first week
- List the five or six controls your auditor will test most (change management, access, vulnerability handling).
- For each, name the system that records it.
- Write down how long that system keeps the record.
- Schedule a collector for any record that expires before your audit window ends.
- Store output in a dated folder with a read-only link for the auditor.
Do not buy or build for item six yet. A signed policy once a year does not need a pipeline.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a recurring check leaves a dated record instead of a one-off screenshot.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation, so scan results land in one place with timestamps. You can run a free scan to see what a dependency inventory looks like.
Quick check
Should I automate everything before my first audit?
No. Automate the high volume, high expiry streams first. A manual process that runs on a calendar is acceptable for low volume items.
Does automated evidence replace the auditor's testing?
No. The auditor still samples and tests. Automation makes the population complete and the timestamps trustworthy.
Sources
Last reviewed: 19 October 2026.
