Auditors require evidence that controls exist and work. Collect continuously, not just before audits.
Documentation: Policies, diagrams, inventories, risk assessments.
Technical evidence: Firewall configs, ACLs, encryption settings, patch levels.
Operational evidence: Access reviews, change tickets, incident logs, training records.
Tips:
- Timestamps prove when evidence was generated
- Central, organized storage
- Retain per requirements (- years typical)
- Automate collection where possible