Compliance Evidence - AuditToolkit Labs

What the evidence package contains

Every audit run produces a tamper-evident evidence package that can be handed directly to an external auditor.

Artifact	Description
Audit output files	Raw and normalised findings per control check
Configuration snapshots	System state at time of audit
SHA-256 checksums	Integrity verification for every artifact
MANIFEST.json	Structured index of all package contents
SHA256SUMS.txt	Flat checksum file for auditor verification
Framework mapping	Findings organised by PCI-DSS, SOC 2, NIST, CIS references
Digital signature	Package signing for chain-of-custody
README for auditors	Human-readable guide to package structure

Trend and trajectory reporting

✓Run comparison showing improvement between audits
✓30/60/90 day compliance trajectory
✓Before/after metrics with compliance deltas
✓Organisation-wide summary for management reporting

Framework coverage

✓CIS Benchmarks — Level 1 and Level 2, Windows Server, Windows Desktop, Ubuntu, RHEL, and major Linux distributions
✓PCI-DSS v4.0 — finding-to-control mapping across Requirements 2, 6, 7, 8, and 10
✓SOC 2 — Trust Services Criteria 2017, audit trail and access control evidence structure
✓NIST SP 800-53 Rev 5 — control family mapping across AC, AU, CM, IA, SC, and SI
✓ISO 27001:2022 — Annex A reference mapping, Statement of Applicability evidence support

Single execution, multiple frameworks. A single audit run produces evidence mapped across every framework simultaneously — no double-running, no manual cross-referencing. One evidence package covers every framework your organisation reports against.

Remediation evidence

✓Full remediation audit trail: operator identity, timestamp, fix, outcome
✓Rollback history for every execution ID
✓Pre-change backups with checksums
✓Post-remediation validation results

EDR & endpoint protection validation

Cyber insurance renewals and supply chain security questionnaires increasingly require evidence that endpoint detection and response tools are installed, current, and active across your estate. AuditToolkit validates EDR health as part of the compliance audit and includes the results in evidence packages.

✓Microsoft Defender for Endpoint — agent installed, service running, definitions current, tamper protection active
✓CrowdStrike Falcon — sensor installed, service running, policy assignment verified
✓SentinelOne — agent installed, service running, protection mode confirmed
✓Carbon Black, Sophos Intercept X, Trend Micro Apex One, ESET Protect, Cylance, Wazuh, OSSEC, Malwarebytes

Each validation check maps to the relevant compliance controls — CIS, NIST, and cyber insurance policy requirements — and is included automatically in the evidence package for the assessment run.

API endpoints for evidence automation

✓POST /api/evidence/collect/assessment
✓GET /api/evidence/packages/<id>/export
✓POST /api/evidence/packages/<id>/sign

View Audit Admin Toolkit Arrange Evaluation

Compliance evidence that auditors accept. Generated automatically. Every run.

What the evidence package contains

Trend and trajectory reporting

Framework coverage

Remediation evidence

EDR & endpoint protection validation

API endpoints for evidence automation