# Upload evidence for an ISO 27001 control
URL: https://docs.autociso.io/product/iso/upload-evidence/
Description: How to attach a file as evidence of a control in the Evidence Vault, what the platform does with it, and how to keep evidence from going stale before an audit.

Every ISO 27001 control you claim to have implemented needs evidence an auditor
can inspect. The [**Evidence Vault**](https://docs.autociso.io/console/iso/evidence/) holds that evidence per control: files you
upload by hand, and snapshots the platform collects from your connected systems.
This guide covers the manual path — attaching a file to a control — and what
happens to it afterwards.

## Before you start

- You need the [**Owner** or **Manager** role](https://docs.autociso.io/getting-started/roles-and-permissions/) in your organisation. ISO 27001 requires [The Growth plan or higher](https://docs.autociso.io/getting-started/plans-and-features/). Members can
  view the vault but cannot upload, re-scan or run a collection.
- Open an ISO 27001 project that is not archived. An archived project shows a
  read-only banner and disables every action on the page.
- Have the control ID at hand (for example `A.7.1`). It must match a control in
  the project's [Statement of Applicability](https://docs.autociso.io/console/iso/soa/) — evidence for a control that is not
  applicable is not useful to an auditor.

## Upload a file

1. In the sidebar, open **Certifications → ISO 27001** and select your project, then choose
   **Evidence**.
2. Click **Upload Evidence** in the page header.
3. Fill in the dialog:
   - **Control ID** (required) — the control this file demonstrates, e.g. `A.7.1`.
   - **Title** — a short label an auditor will understand, e.g.
     `Physical Entry Log — Q1 2026`. If you leave it empty the row is titled
     `Manual Evidence — <control ID>`.
   - **File** (required) — PNG, JPEG, WebP, PDF, JSON or plain text, up to 50 MB.
     On a phone or tablet the picker also offers the camera, so a photo of a
     visitor log or a server-room sign-in sheet can be captured on the spot.
4. Click **Upload**.

The new row appears in the table with the control, the title, the upload time
and the status **Fresh**. Any earlier evidence for the same control is marked
**Stale** at that moment — the newest upload is the one an auditor sees as
current, and the older rows stay in the vault as history. Use the **All /
Fresh / Stale** filter above the table, or the source buttons next to it
(`manual` for uploads, one per connected system for collected evidence), to
narrow the list.

## What the platform does with the file

- **Integrity hash.** A SHA-256 of the file is computed on upload and shown in
  the evidence details. Click the row, then **Copy** next to the hash, to quote it
  in an audit pack or a management review.
- **Summary.** The details dialog shows a one-line summary of the item. For
  evidence collected from a connected system this is an AI-generated,
  de-identified description of what was found; for a manual upload it records
  the file type, the control and who uploaded it. The original file is stored
  unchanged.
- **Export.** From the details dialog you can download the item's metadata as
  JSON — control, title, hash, timestamps and summary — for an external audit
  tool.

## Keep evidence from going stale

Evidence ages. Items older than the 90-day freshness threshold are marked
**Stale** and a warning banner at the top of the page counts the affected
controls (naming your certification body when one is set on the project).

- **Re-scan** a single control from its row, or click **Rescan all stale** in the
  banner, to trigger a fresh collection for controls that are connected to an
  integration.
- **Run Collection** in the page header runs every scheduled collector at once
  (see [Evidence Collection Agent](https://docs.autociso.io/console/operations/evidence-agent/)).
  The page subtitle shows when the last collection finished.
- For controls that only have manual evidence, upload a newer file — it becomes
  the current item and the previous upload is kept as a stale history row.

Stale evidence does not fail a control, but it is the first thing a Stage 2
auditor will ask about. Clear the banner before the audit window, then check the
[Audit Readiness Score](https://docs.autociso.io/console/iso/readiness/).

## Troubleshooting

| Symptom | Cause | What to do |
|---------|-------|------------|
| **Upload** button is disabled | You are a Member, or the project is archived | Ask an Owner or Manager, or restore the project |
| "Upload" stays disabled in the dialog | Control ID or file is missing | Both fields are required |
| The file is rejected | Unsupported type or larger than 50 MB | Export to PDF or PNG, or split the file |
| An older row turned **Stale** right after an upload | Expected: a new upload supersedes earlier evidence for the same control | Nothing to do — the new row is **Fresh** |