Evidence automation and the vault

Evidence automation in SigmaTrust means collector agents gather artefacts from your systems on a schedule — access lists, configuration states, review records, training completions — into a governed evidence vault where each artefact is dated, versioned and mapped to the controls and frameworks it satisfies. Connector governance defines what each collector may reach and who approved it. The result is that an auditor's evidence request is answered from the vault rather than assembled by hand.

The real cost of manual evidence

Ask any team what an audit costs and they quote the auditor's fee. The larger cost is internal: weeks of engineers screenshotting consoles, exporting user lists and hunting for the version of a policy that was current in March. That work is repeated for every framework, every audit and every serious customer questionnaire, because the output goes into a folder that is stale the day after it is filed.

Evidence automation attacks exactly this. The artefact is collected once, on schedule, and mapped to every control that needs it — so the marginal cost of the next framework or the next questionnaire approaches zero.

How collection stays trustworthy

Automated evidence is only worth what its provenance is worth, so the controls around collection matter as much as the collection:

• Collector agents run on defined schedules, so every artefact carries the date it was true — not the date someone remembered to capture it.
• Connector governance records what each connector may access, who approved it and when — because an evidence pipeline with unaudited access is itself a finding waiting to happen.
• The vault versions artefacts rather than overwriting them, so you can show what the access list looked like in March, not only today.
• Every artefact is mapped to the controls and frameworks it satisfies; nothing sits in the vault as an orphan file whose purpose only one person remembers.
• Failed collections surface as degraded readiness rather than silently leaving a gap you discover during fieldwork.
• Manual evidence still has a place — some artefacts are inherently human — and it enters through the same vault with the same dating and mapping, not through a side channel.

From vault to audit pack

The vault is the store; the audit automation workspace is what turns it into an assessment. When an audit or a customer review begins, the workspace assembles the evidence pack for the framework in question from what the vault already holds, flags the gaps that need human attention, and gives the assessor a single place to request, receive and conclude on evidence. Decisions are recorded against the evidence they were based on — which is precisely what a regulator or certifying body means by evidence-backed audit decisions.

Because CyberSigma's own CERT-In empanelled, PCI QSA-authorised auditors work in the same workspace, the pack the platform assembles is one an accountable assessor has already agreed is sufficient — not a folder you hope will satisfy whoever turns up.

What to automate first

Rank your evidence by how painful it is to produce by hand, and automate from the top. For most organisations that means access reviews and user lists first, configuration and hardening states second, and training and policy acknowledgements third. Contracts, board minutes and physical-security artefacts stay manual — automating them is possible but rarely worth it. A scoping interview establishes this ordering before any connector is switched on, because automating the wrong evidence first is how these projects lose momentum.

What counts as evidence, and what can be collected automatically?

Anything an assessor relies on to conclude a control operates: access lists, configuration states, review and approval records, training completions, logs and policy acknowledgements. The automatable share is the recurring, system-generated portion — typically the majority by effort. Inherently human artefacts such as board minutes enter the same vault manually with the same dating and mapping.

How do we control what collectors can access?

Through connector governance: each connector's scope, approver and approval date are recorded, and collectors only reach what was granted. An evidence pipeline with ungoverned access would itself be an audit finding, so this is treated as a first-class control rather than a setting.

Can we prove what the evidence looked like at a past date?

Yes — the vault versions artefacts rather than overwriting them, and each carries the date it was collected. Point-in-time questions ('what did the admin list look like in March?') are answered from history, not reconstruction.

What happens when a collection fails?

It surfaces as degraded readiness on the affected controls rather than failing silently. The distinction matters: a gap you see in-week costs a fix; a gap you discover during fieldwork costs a finding.

Does the same evidence serve multiple frameworks?

Yes — artefacts are mapped to controls, and controls map across frameworks. Evidence collected once for ISO 27001 serves SOC 2, PCI DSS and DPDP wherever the requirements overlap, which is most of the effort in practice.

Who judges whether the evidence is sufficient?

An accountable assessor, not the software. CyberSigma's CERT-In empanelled, PCI QSA-authorised auditors work in the same audit workspace, request what is missing through it, and record their conclusions against the evidence — which is what makes the pack defensible to a regulator or certifying body.