Evidence that comes from systems can be collected automatically: SBOMs per release, scan history, branch and review settings, pipeline logs, ticket timelines and signing records. Evidence that records judgment, such as risk acceptance, policy approval and incident review, needs a named person. Automate the first group so people can spend time on the second.
The two groups
| Evidence | Source | Automatable |
|---|---|---|
| Component inventory | Build or lockfile parser | Yes |
| Vulnerability scan history | Scanner output with timestamps | Yes |
| Time to fix findings | Ticket created and closed dates | Yes |
| Branch and review rules | Repository settings via API | Yes |
| Pipeline run logs | CI system | Yes |
| Signing or provenance records | Release pipeline | Yes |
| Policy approval | Signed record by owner | Partly, needs a human sign-off |
| Risk acceptance | Written decision with owner and date | No |
| Incident postmortem | Facilitated review | No |
Why timestamps matter
Auditors and buyers ask whether a control operated over time, not whether it exists today. A screenshot proves one moment. System-generated records with dates prove a period. See system-generated reports as audit evidence: completeness and accuracy for what makes such exports acceptable.
Steps to start
- Pick the five questions you receive most often.
- For each, name the system that already holds the answer.
- Set a scheduled export or integration that stores a dated copy in an evidence folder.
- Record the collection method in one line, so a reviewer can reproduce it.
- Review the folder monthly for gaps.
For the folder layout, see questionnaire evidence pack: folder structure.
Check for blind spots
Automation collects what it is pointed at. If a repository is not connected, it is missing from the evidence and nobody notices. Keep an inventory of in-scope repositories and compare it with the connected set. Asset discovery helps here by finding what you forgot.
Freshness
Decide how old an item can be before you stop using it. A scan result from six months ago does not answer a question about current exposure. See how fresh must compliance evidence be.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how checks repeat over time. Each repeat is a dated record you can file as evidence.
Quick check
Is automated evidence accepted by auditors?
Often yes, when you can show how it was generated and that it is complete. Confirm with your auditor early.
Should we automate everything?
No. Automate repeatable system data. Keep human sign-off where judgment is the point.
Safeguard provides compliance and evidence automation, SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
