Evidence created as you go, not rebuilt in audit week.
When a control test completes, Kmetog writes the proof straight away: what was checked, where the data came from, the rule applied, the result and when it happened. By the time an auditor asks, the file already exists.
- control
- AC-02 Access review
- mapped to
- SOC 2 CC6.2, ISO A.5.18
- source
- identity provider (read-only)
- test rule
- inactive > 90d = 0
- result
- pass
- collected
- at test completion, UTC
- sha-256
- 9f2c41e0b7d3...
Every record answers the questions an auditor will ask.
Screenshots dropped into a shared folder rarely explain themselves. Kmetog evidence records carry their own context.
- The raw data. Exports or configuration snapshots read during the test, kept alongside the summary.
- The test logic. The rule that was applied and the threshold for a pass.
- The mapping. Which control and which framework clauses the record supports.
- The population. Counts of what was in scope, so sampling questions have an answer.
Records that can show they have not been touched.
Each evidence record is timestamped at collection and sealed with a SHA-256 digest. Later edits create a new version rather than overwriting the original, so the history stays intact.
- Collection time. Recorded in UTC at the moment the test finished.
- Content digest. A hash of the record, re-checked whenever the file is exported.
- Version history. Superseded records remain available, clearly marked.
From passed test to auditor request
What happens between a check passing and an auditor asking for proof.
- Test passes
Encryption at rest is confirmed across storage volumes.
SC-28 / result: pass - Record written
Scan output and summary are bundled with test logic.
encryption_scan.json - Sealed
The record is timestamped and hashed on collection.
sha-256 4be71a09... - Exported
The auditor receives a pack organised by framework clause.
export: SOC2_CC6_pack.zip
What teams usually ask
What formats do auditors receive?
Evidence exports as PDF summaries with the underlying data files, grouped by framework and clause. Packs can be scoped to a single control, a framework or a full audit period.
Can we add evidence Kmetog did not generate?
Yes. Manually uploaded files are attached to controls in the same way, timestamped on upload and clearly labelled as provided by your team.
How long is evidence kept?
Retention is configurable per workspace to match your framework and contractual obligations. See the Security page for how evidence is stored.
Stop reconstructing last quarter.
Let us show you what an evidence pack for your framework looks like before your next audit.