Can you start collecting compliance evidence before buying a tool?

Yes. You can start collecting compliance evidence today with a shared folder, a simple register, and a monthly calendar reminder. Save dated exports from the systems you already use. When you pick a tool later, you will have history instead of a blank start, and the tool will have something to compare against.

TL;DR: Do not wait for software to begin. Evidence that you did not save is gone, and some systems only keep their logs for a limited time. Spend about two hours setting up, then about one hour a month. Start with five kinds of records, name files the same way every time, and note the owner and date for each.

Definition box. An evidence register is a simple list that says what evidence you keep, where it lives, who owns it, and when it was last updated. It can be a spreadsheet. Its job is to make sure nothing important is forgotten.

Why should a small team not wait for a tool?

Buying and setting up a compliance tool takes time. You compare options, get approval, connect systems, and fix the first batch of failing checks. For many teams that is weeks. During those weeks, your company keeps working, and records keep being created or lost.

Here is the key problem. Many systems throw away old records. GitHub's documentation says an organization's audit log lists events from the last 180 days, and by default shows only the past three months. If you wait six months to start, the first months of your history may already be gone from that source.

Also, an audit looks at a window of time. The earlier your records begin, the longer the story you can tell. Starting a folder today costs almost nothing and protects you from losing the early part of that story.

There is a second benefit. Doing it by hand for a month or two teaches you what you actually need. When you later evaluate tools, you will know your own controls, your owners, and your weak spots, so you can judge a tool on real needs. Our guide on choosing between a spreadsheet and a platform for your first SOC 2 goes deeper on that decision.

What five kinds of evidence should you start with?

Start small. These five cover most of what buyers and auditors ask about first.

You do not need to boil the ocean. If you can only manage three, begin with the people list, code change review, and policies.

How do you set it up in two hours?

Follow these steps once.

1. Create one shared folder that several people can reach, not a personal drive. Name it clearly, such as "Security Evidence."
2. Make one subfolder per control area: people, code, access, vulnerabilities, policies. Our guide on naming and structuring an evidence folder has ideas.
3. Pick a file naming rule and use it every time. For example: year, month, day, then the system, then a short description. A name like "2026-11-01 code-host merged-changes.csv" sorts itself.
4. Create the register. Use a spreadsheet with columns for evidence name, control it supports, source system, owner, frequency, location, and last updated. See what columns a register should have.
5. Assign an owner for each row. One named person, not a team.
6. Put recurring reminders in a shared calendar. One for the first of each month, one each quarter.
7. Save the first set of exports now. Do not wait for the reminder. Today's export is the first dated record.

What does a monthly hour look like?

On the first working day of each month, the owner of each row does three things:

1. Export the record from the source system, if the system allows it.
2. Save the file in the right folder with the agreed name.
3. Update the "last updated" column in the register.

Then one person, perhaps the head of engineering or an operations lead, spends ten minutes scanning the register for rows that were not updated. Any row more than a month late gets a nudge.

Exports from the system itself, with a system timestamp, are better than screenshots or hand typed lists. They are harder to edit and easier to explain. If you want the fuller argument, read compliance evidence: hash, not screenshot.

What should you avoid?

• Do not backdate anything. If you are starting in November, your first record is dated November. An honest start is fine. A faked history is a serious problem.
• Do not store secrets in the folder. Exports can include email addresses, names, and sometimes tokens. Share the folder with a small group and remove sensitive columns when you can.
• Do not collect everything. Keep what supports a control. Extra files make the folder harder to use.
• Do not skip the register. A folder with no list of what should be in it hides gaps.

A worked example with invented numbers

The numbers below are invented for illustration.

A nine person company decides on October 20 that it will pursue a SOC 2 examination. It plans to pick a compliance tool in the first quarter, but nothing is chosen yet. The head of operations sets up the folder and register that same afternoon, which takes two hours.

By the end of January, the company has:

• Three monthly people exports (November, December, January).
• Three monthly code review exports. Each shows the merged changes and approvers. Together there are 212 merged changes; 207 had a second reviewer and 5 are explained by outage tickets.
• One quarterly access review, signed on December 15.
• Policies with approval dates.

When the company connects a tool in February, it already has a four month history. It also knows the five owners by name and has found two gaps, such as one contractor account that was never reviewed. Those were found by hand, fixed in December, and written down. The tool then carries the process forward.

Compare that with a company that waited. In February, it would have no records at all from the earlier months, and for the code host it may have lost part of the log.

How does this fit with automation later?

Think of the manual routine as a rehearsal. Once you have a tool, you can ask it to do the exports on a schedule and keep the dated results, which is the heart of how to automate evidence collection. Some items will stay manual even then, such as policy approvals and risk decisions, as covered in which evidence cannot be automated.

Your register keeps its value. It becomes the checklist you use to confirm the tool covers everything that matters.

Where does Safeguard fit?

When you are ready to automate, Safeguard offers compliance and evidence automation that helps teams collect and organize evidence and keep it current. For the software side of your records, Safeguard's dependency scanning and SBOM (software bill of materials, a list of the parts inside your software) features can produce a dated inventory of what your code uses. You can try a free scan at gold.safeguard.sh/scan.

Try it yourself

Click through it at your own pace, or open it full screen.

Click through the demo to see a dependency inventory, the list of parts your software uses. Think about how a dated copy of this list each month could become one row in your register.

Quick check

Sources

• Reviewing the audit log for your organization, GitHub Docs

Last reviewed: 19 October 2026.