The Evidence page is a centralized workspace for managing all evidence used to support your controls. It helps you streamline evidence collection, maintain version history, and ensure control readiness across audits.

Evidences can be mapped to one or more controls, updated over time, and reused across frameworks. Keeping evidence current and correctly mapped reduces audit gaps and improves overall readiness.

Note: Pre-mapped evidence is available only to SOC 2 or ISO 27001:2022 customers who joined Drata after August 27, 2024.

Go to Compliance > Evidence. This page shows all evidence in your workspace.

From here, you can:

Use this page as your starting point when investigating why a control is not ready or preparing for an audit.

Each evidence item has a status that indicates whether it needs attention and how it affects control readiness.

Each evidence item has a source that indicates how the artifact is provided.

Each artifact (evidence item) in Drata's Evidence Library has its own Evidence Owner field. This is separate from the control owner field on the mapped DCF control. This separation is intentional because the person responsible for collecting and maintaining evidence may be different from the person who owns the control.

In practice:

These owners can, and often do, belong to different people, especially in larger or decentralized organizations.

Artifact templates in the Evidence Library include an Evidence Owner field. This field is distinct from the control owner and designates who is specifically responsible for evidence collection and maintenance for that artifact.

This separation helps teams:

Drata's Evidence Library serves as a repository for all the evidence you need to collect across your controls.

The Evidence Library page is preloaded with evidence mapped to your controls. These pieces of evidence are commonly requested by auditors and help you prepare for an audit while maintaining compliance. If any evidence does not apply to your organization, you can delete it (individually or in bulk) or remove the mapping from the associated control.

Ensure that all evidence uploaded to the library is valid, up-to-date, and aligns with the control requirements. Valid evidence improves control readiness and reduces the risk of gaps during audits.

Note: Pre-mapped evidence is available only to customers with SOC 2 or ISO 27001:2022 and who joined Drata after August 27, 2024.

Manual evidence is evidence created by a user. Users can create evidence and attach a file, URL, or ticket as artifacts.

When you select a manual evidence, you will be redirected to a page with a Details tab with more specific sections such as: Overview, Linked controls, and Current artifact.

The Overview section allows you to add a name, description, implementation guidance, and owner for the evidence. This information ensures proper collaboration and tracking.

This section allows you to specify which controls apply to the evidence. Since there is a many-to-many relationship between evidence and controls, a single piece of evidence can apply to multiple controls.

The Current Artifact section fulfills the evidence requirement. After creating evidence, you can upload an artifact or specify the creation and renewal dates.

Artifact sources include:

When a monitoring test runs, Drata generates a test evidence PDF. This file lists failed resources along with any exclusions for that test. This PDF is the evidence that goes to the auditors.

Test evidence appears in the Evidence Library and the source is labeled as Test. These items are automatically created and cannot be modified, except for the evidence owner. To update test details or control mappings, you must go to the Monitoring or Controls pages.

These are the statuses for evidence and how each applies to control readiness:

When you update manual evidence, previous versions appear in the Past artifacts tab, preserving historical records.

For test evidences, the evidences for the past test runs are shown in the Past evidences tab.

Best practices include ensuring the uploaded evidence is highly relevant and valid for the associated controls. Avoid using outdated or incorrect artifacts as they may negatively affect control readiness.

You can upload evidence directly from a cloud provider.

Supported File Types:

Supported Cloud Providers: Google Drive, Microsoft OneDrive, SharePoint, Okta Box, Dropbox

File Size Limits: Individual Files: 50 MB · Zipped Files: 100 MB (unzipped, each file must be under 50 MB)

Steps to Add Evidence in Evidence Library:

On the Evidence Library page, there is a table of evidences. If the evidence status needs attention like upcoming renewal or past renewal, the banner on the top will guide you to the next steps.

You can also use filters to sort by status, source, owner, or framework. You can also search for evidences by name or linked controls.

Select the manual evidence or select Update to modify manual evidence.

Under the Artifact section, if you have updated your evidence with a new artifact, the previous artifacts will be shown in the past artifacts tab. Select View file to view the artifact or Update dates to update the creation or the renewal dates.

Users can also bulk reassign evidence owners by selecting one or more test or manual evidences and selecting Assign evidence owner.

Test evidence details like overview or linked controls cannot be updated. The only editable attribute is the evidence owner. To update overview or linked controls, please update the corresponding tests from the Monitoring or the Controls page.

⚠️ Warning: Deleting manual evidence is a permanent action. The evidence will be removed and deleted from all linked controls.

Delete multiple manual evidences:

Delete specific evidence:

Test evidences cannot be deleted. If users do not want a test to generate evidence, they can do so by disabling the test.