Evidence
Evidence is the proof behind your compliance program: the access review export, the training completion report, the configuration screenshot that shows a control actually operated. A control implementation describes how a control works; evidence demonstrates it kept working through the audit period.
Auditors don't take your word for it; they sample controls and ask for the artifacts. When evidence is collected on schedule, linked to the controls it supports, and current for the audit period, an audit is mostly retrieval. When it isn't, audit preparation means hunting through inboxes and shared drives for a report someone generated eight months ago, or discovering it was never generated at all.
Centralizing evidence in Openlane also means one artifact can serve every framework that needs it. A quarterly access review linked to the right controls counts toward System and Organization Controls 2 (SOC 2) and ISO 27001 at once, instead of being uploaded twice into two portals.
Evidence Status
Evidence moves through a review flow from creation to auditor approval: you submit the record, an internal reviewer checks it against the control, and the auditor reviews and accepts or rejects it. Two exception states need action outside that flow: Missing Artifact means a required file or substantiating item is absent and the record cannot progress until it is attached, and Needs Renewal means the artifact is outdated for the current period and must be recollected.
Collecting Evidence
Submit evidence from the Evidence page with a name, description, collection procedure, source, and the artifact itself, then link it to the controls it supports; see Create Evidence for the walkthrough.
Set a renewal date on everything. Most evidence goes stale (a Q1 access review doesn't cover Q3), and renewal dates plus recurring tasks are what turn evidence collection from a pre-audit scramble into a routine.
What Makes Evidence Audit-Ready
The recurring reasons evidence gets rejected are quality problems, not missing artifacts:
- Prefer system-generated over hand-made. A timestamped configuration export with source metadata beats a user screenshot, which can be manipulated and rarely shows when or where it was taken.
- Cover the period, not a moment. If the control operates continuously, one good day in March doesn't demonstrate the year. Match collection frequency to how the control operates.
- Pull from production. Evidence from development or test environments doesn't prove the production control exists.
- Record how you collected it. The collection procedure field exists so an auditor can trust the artifact's provenance; fill it in like someone skeptical will read it.
Example Evidence by Framework
If you're not sure what artifact a given control needs, each framework page includes a reference table of commonly evidenced control areas and the artifacts that typically satisfy them:
FAQ
Can one piece of evidence support multiple controls?
Yes, link it to every control it demonstrates. This is the main payoff of centralizing evidence: cross-framework controls share artifacts instead of duplicating them.
How often should evidence be renewed?
Match the control. A control that operates quarterly needs quarterly evidence; an annual policy review needs annual evidence. Set the renewal date when you create the evidence and let the dashboard flag what's due.
What's the difference between evidence and a control implementation?
The implementation is the narrative: how the control operates in your environment. Evidence is the artifacts proving it operated. Auditors read the narrative first, then test it against the evidence.
Where do I see what evidence fields are available?
The common ones are on the Create Evidence page; the complete list lives in the GraphQL object reference.
For programmatic access, see the Evidence GraphQL examples in the developer docs.