Upload evidence for an ISO 27001 control

Every ISO 27001 control you claim to have implemented needs evidence an auditor can inspect. The Evidence Vault holds that evidence per control: files you upload by hand, and snapshots the platform collects from your connected systems. This guide covers the manual path — attaching a file to a control — and what happens to it afterwards.

Before you start

• You need the Owner or Manager role in your organisation. ISO 27001 requires The Growth plan or higher. Members can view the vault but cannot upload, re-scan or run a collection.
• Open an ISO 27001 project that is not archived. An archived project shows a read-only banner and disables every action on the page.
• Have the control ID at hand (for example A.7.1). It must match a control in the project’s Statement of Applicability — evidence for a control that is not applicable is not useful to an auditor.

Upload a file

1. In the sidebar, open Certifications → ISO 27001 and select your project, then choose Evidence.
2. Click Upload Evidence in the page header.
3. Fill in the dialog:
   • Control ID (required) — the control this file demonstrates, e.g. A.7.1.
   • Title — a short label an auditor will understand, e.g. Physical Entry Log — Q1 2026. If you leave it empty the row is titled Manual Evidence — <control ID>.
   • File (required) — PNG, JPEG, WebP, PDF, JSON or plain text, up to 50 MB. On a phone or tablet the picker also offers the camera, so a photo of a visitor log or a server-room sign-in sheet can be captured on the spot.
4. Click Upload.

The new row appears in the table with the control, the title, the upload time and the status Fresh. Any earlier evidence for the same control is marked Stale at that moment — the newest upload is the one an auditor sees as current, and the older rows stay in the vault as history. Use the All / Fresh / Stale filter above the table, or the source buttons next to it (manual for uploads, one per connected system for collected evidence), to narrow the list.

What the platform does with the file

• Integrity hash. A SHA-256 of the file is computed on upload and shown in the evidence details. Click the row, then Copy next to the hash, to quote it in an audit pack or a management review.
• Summary. The details dialog shows a one-line summary of the item. For evidence collected from a connected system this is an AI-generated, de-identified description of what was found; for a manual upload it records the file type, the control and who uploaded it. The original file is stored unchanged.
• Export. From the details dialog you can download the item’s metadata as JSON — control, title, hash, timestamps and summary — for an external audit tool.

Keep evidence from going stale

Evidence ages. Items older than the 90-day freshness threshold are marked Stale and a warning banner at the top of the page counts the affected controls (naming your certification body when one is set on the project).

• Re-scan a single control from its row, or click Rescan all stale in the banner, to trigger a fresh collection for controls that are connected to an integration.
• Run Collection in the page header runs every scheduled collector at once (see Evidence Collection Agent). The page subtitle shows when the last collection finished.
• For controls that only have manual evidence, upload a newer file — it becomes the current item and the previous upload is kept as a stale history row.

Stale evidence does not fail a control, but it is the first thing a Stage 2 auditor will ask about. Clear the banner before the audit window, then check the Audit Readiness Score.

Troubleshooting