Automated compliance evidence: less audit pain, more control
Compliance evidence is the proof that a control works: an access log, a restored backup or an approved policy. However, gathering it by hand eats up weeks before every audit. This guide explains what you can automate, what still needs a person and how to get auditors and supervisors to accept it.
In 30 seconds: evidence shows that a control operates throughout the audited period, not just the day before. Technical records (access, backups, patches, training) lend themselves to automatic, continuous collection. In contrast, management decisions, risk analysis and continuity tests need human judgement. For an auditor to trust automated compliance evidence, they need to know its source and its date. They also need assurance that nobody has altered it.
What compliance evidence is
Evidence is any information that lets a third party check that a control exists and works. It can be a document, such as a signed policy. It can also be an access log, a multi-factor authentication setting or a restore report. Therefore, without it a control is just an intention.
Moreover, the burden of proof sits with you. The GDPR says so explicitly: the controller must comply and “be able to demonstrate” it (Article 5(2), accountability). Similarly, the NIS2 Directive lets the authority request evidence that cybersecurity policies are in place. Among other things, it cites the results of security audits and the underlying evidence (Articles 32(2)(g) and 33(2)(f)). So compliance evidence is not paperwork for the auditor: it protects you in front of a supervisor.
What auditors and supervisors ask for under each framework
In addition, each framework has its own reviewer and focus. The table sums up who looks at your compliance evidence and which articles they rely on.
| Framework | Who reviews | What they expect to see |
|---|---|---|
| ISO 27001 | Certification body (annual surveillance and recertification every three years) | Documented information (clause 7.5), monitoring and measurement results (9.1), internal audits (9.2) and management review (9.3) |
| ENS | Self-assessment for BASIC category; a certification body accredited by ENAC for MEDIUM and HIGH | Statement of Applicability, activity logging (op.exp.8) and an ordinary audit at least every two years (Article 31) |
| NIS2 | National competent authority | Documented policies, audit results and the evidence behind them (Articles 32(2) and 33(2)) |
| DORA | Financial supervisor: in Spain, Banco de España, CNMV or DGSFP, depending on the entity | An ICT risk framework documented and reviewed at least once a year, regular internal audit and the register of information on ICT third parties (Articles 6 and 28(3)) |
| GDPR | Data protection authority (the AEPD in Spain) | Records of processing activities (Article 30), documentation of every breach (Article 33(5)) and regular testing of the effectiveness of measures (Article 32(1)(d)) |
In Spain, NIS2 remains untransposed as of 14 October 2026, and Royal Decree-Law 12/2018 still applies. We cover it in our article on the pending NIS2 transposition and the CJEU case. Even so, it makes sense to prepare your compliance evidence to the Directive’s standard, because the Spanish law will have to include it.
Which compliance evidence you can automate
The rule is clear: automate what a system already records and leave to people what requires judgement. That way, the team spends its time reviewing, not taking screenshots. What automates well:
- Joiners, leavers and permission changes from the user directory.
- Multi-factor authentication status by user and by application.
- The result of every backup and of restore tests.
- Pending patches and open vulnerabilities by severity.
- Centralised activity logs and monitoring alerts.
- Awareness courses completed by each employee.
- Asset inventory and drift from the security baseline.
What needs human judgement:
- Approval of the measures by the management body, which Article 20 of NIS2 requires.
- Risk analysis and acceptance of residual risk.
- Management review and lessons learned after an incident.
- Deciding whether you need to report a breach within 72 hours to the authority.
- Also, the assessment of a critical supplier before signing.
Finally, between the two sits the hybrid model. For example, every quarter the system prepares the list of users with access to a critical application. Then the owner reviews and signs it. In other words, the machine provides the data and the person makes the decision. That model matches what auditors look for: continuous control with documented human oversight.
Examples by control: what to collect and how often
The table lists common compliance evidence with its reference in each framework. The frequency is indicative: your risk analysis sets it, not the regulation.
| Control | Automated evidence | Indicative frequency | References |
|---|---|---|---|
| Access management | Joiners, leavers and permissions, with a signed review | Continuous; quarterly review | ISO A.5.15 and A.5.18; NIS2 21(2)(i); DORA 9(4)(c) |
| Multi-factor authentication | Users and applications with MFA enabled | Daily | ISO A.8.5; NIS2 21(2)(j); ENS op.acc.6 |
| Backups | Log of every backup and every test restore | Daily; periodic restore | ISO A.8.13; ENS mp.info.6; DORA Art. 12 |
| Vulnerabilities | Scans and patch status by severity | Weekly or continuous | ISO A.8.8; ENS op.exp.4; NIS2 21(2)(e) |
| Activity logging | Centralised, protected logs with synchronised time | Continuous | ISO A.8.15 and A.8.17; ENS op.exp.8; DORA RTS, Art. 12 |
| Training | Courses completed per person | Monthly | ISO A.6.3; NIS2 21(2)(g); DORA 13(6) |
| ICT suppliers | Contracts, assessments and register of information | At contracting and yearly | ISO A.5.19 to A.5.22; DORA 28(3); GDPR Art. 28 |
If you are a financial entity, the supplier register is key proof in itself. That is why we cover it in the guide to the DORA register of information on ICT third parties.
Chain of custody for compliance evidence
Automated compliance evidence only counts if the auditor can trust it. For that, they need to know where it comes from, when the system generated it, who has accessed it and whether anyone has changed it.
- Source: each item keeps its originating system and the control it answers.
- Reliable time: clocks must stay synchronised with a reference source. ISO 27001 control A.8.17 and Article 12 of DORA’s Delegated Regulation (EU) 2024/1774 both require it.
- Integrity: a cryptographic hash and write-once storage let you show that nobody has altered it.
- Access and retention: only authorised roles can reach it, for a defined period. Likewise, NIS2 Implementing Regulation (EU) 2024/2690 asks you to keep logs for a predefined period and protect them from unauthorised changes.
However, this does not turn the evidence into forensic proof. If an incident might end up in court, also apply ISO 27001 control A.5.28 (collection of evidence). Then preserve the data with a forensic procedure.
How to start without a big project
- First, pick the ten or twelve controls that cost you the most time at each audit.
- Next, connect the sources you already have: directory, backups, vulnerability scanner and training platform.
- Then define an owner, a frequency and a retention period for each piece of evidence.
- In addition, review controls without recent proof every month and fix them before the audit.
- Finally, reuse each item in every regulation that asks for it with a shared control map across regulations.
With that sequence, compliance evidence stops being a sprint before the audit. Instead, it becomes a by-product of day-to-day operations.
Frequently asked questions
Do auditors accept automated compliance evidence?
Yes, as long as they can verify its source, its integrity and that it covers the whole audited period. In fact, a continuous series of records is more convincing than a screenshot from the day before. Even so, the auditor may ask for a live demonstration or a sample to cross-check the data.
How long should you keep compliance evidence?
There is no single period. At a minimum, keep what covers the audit cycle: three years for ISO 27001 and two for the ENS. In addition, DORA and Regulation 2024/2690 ask you to set a retention period for logs. Likewise, if the proof contains personal data, limit the period to what is necessary, as the GDPR requires.
Is a screenshot valid proof?
It can work for a one-off fact, but it is weak: it does not show the source or prove that the control worked before. That is why you should replace it with dated exports from the system itself or with queries the auditor can rerun.
Can the same evidence serve several regulations?
Yes, and it is the most efficient way to work. For example, a restore report serves ISO 27001 (A.8.13), the ENS (mp.info.6), DORA (Article 12) and the GDPR (Article 32(1)(c)). Thus you only need to link it once to each requirement.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC collects compliance evidence automatically and links it to a common control model: one control, many regulations. As a result, you see, service by service, which controls have recent proof and which do not. Moreover, the regulatory clock alerts you before every review or deadline. Incident management and the third-party register also leave their own documentary trail. See the ISO 27001 and ISO 22301 guide or request a demo.
