💡 Still using the classic Drata experience? Refer to Evidence Library Overview for the original UI.
The Evidence page is a centralized workspace for managing all evidence used to support your controls. It helps you streamline evidence collection, maintain version history, and ensure control readiness across audits.
Evidences can be mapped to one or more controls, updated over time, and reused across frameworks. Keeping evidence current and correctly mapped reduces audit gaps and improves overall readiness.
Note: Pre-mapped evidence is available only to SOC 2 or ISO 27001:2022 customers who joined Drata after August 27, 2024.
Access the Evidence page
Go to Compliance > Evidence. This page shows all evidence in your workspace.
From here, you can:
Select an evidence item to view details or add an artifact
Select multiple evidence items to take bulk actions, including:
Delete evidence
Assign or update an evidence owner
Sync evidence to the SafeBase Trust Library (if enabled)
Use this page as your starting point when investigating why a control is not ready or preparing for an audit.
Evidence Status and Readiness Impact
Each evidence item has a status that indicates whether it needs attention and how it affects control readiness.
Needs artifact
The evidence does not have an artifact.
Can negatively impact control readiness.
Recommended Action: Upload an artifact to avoid negative impact on control readiness.
Needs renewal
The evidence has an artifact, but the renewal date has passed.
Can negatively impact control readiness.
Recommended Action: Update the artifact to restore readiness.
Upcoming renewal
The evidence has an artifact, and the renewal date is within the next two months.
Can positively impact control readiness.
Recommended Action: Plan to update soon to avoid lapses.
Ready
The evidence has a current artifact, or valid test evidence exists for a passing or failing test.
Can positively impact control readiness.
Recommended Action: No immediate action needed.
Error
The associated test is in an error state. You can still view previously generated test evidence.
Does not impact control readiness.
Recommended Action: Review the related test.
Evidence Sources
Each evidence item has a source that indicates how the artifact is provided.
File: Upload a file from your computer or cloud storage. Maximum size: 50 MB per file. Zipped files are automatically unzipped and validated.
URL: Use a link for web-based or sensitive evidence.
Ticket: Link evidence from a connected ticketing system.
Test: Test evidence is automatically generated from monitoring tests and appears with the source labeled Test.