Skip to main content
Audit Package Control Evidence

This article covers the structure for control evidence package

Updated over 4 months ago

Audit Package

Drata audit package contains data from four sources:

1. Monitored Evidence

For monitored controls, we automatically attach relevant evidence based on audit dates selected by the auditors.

Controls including monitored evidence

Almost all monitored controls (except for controls related to personnel compliance) include this type of evidence. To see a full list of these controls, navigate to your Controls page and filter by Monitored. You may have to scroll down the filters to filter for your monitored test. Select your desired control and within the drawer scroll to Automated Testing and select the desired test to select the results icon () to view the raw results. You will then be redirected to the events on the Event Tracking page for more information.

2. Manual Evidence

In the audit package, we include linked policies and/or external files/URLs.

Controls including manual evidence:

Manual evidence attached to any control should be available in the audit package. To see this evidence for a specific control, select the desired control and then within the drawer, scroll down to the Control Evidence section and then select Download Files.

3. Personnel Evidence

In the audit package, we produce three folders, one for current employees, another for new hires, and a third for former employees, which contain all the necessary information for the auditor's selected personnel samples. Additionally, we produce a policy acceptance overview CSV for each category. The policy acceptance overview provides a summary and breakdown of the sampled personnel’s policy acceptance statuses on active policies. To see sample personnel evidence, go to 'Personnel', select any employee or contractor, go to the menu above, and select 'Download'.

Note: The downloaded PDFs have different levels of information based on the status of the personnel. Additionally, the ‘Policy acceptance overview’ CSV excludes offboarded personnel from your sampling.

Controls including personnel evidence:

Any controls related to personnel compliance should include this evidence. (Some examples: DCF-32, DCF 36, DCF-37, DCF-39, DCF-40, DCF 44, DCF 45, DCF-48, DCF-49, DCF-50, DCF-51, DCF-52). Learn more about personnel at Personnel Overview.

Note: You may only see a subset of these controls depending on your frameworks.

4. Special Evidence

These are controls with special treatment in Drata. Data for each control can be found in different part of the application.

For current personnel, the associated PDFs have additional sections (aka 'Special Evidence'—including background check, accepted policies, device data, etc. For former personnel, less information will be included in the PDF.

Controls including special evidence:

Control

Data Location

DCF-16

Evidence Library Page -> Report with creation date within audit time period.

DCF-20

Generate a Zip including all Assets in the asset section

DCF-21

Reports/docs Page -> Document with the type Architecture Diagram and creation date within Audit time period.

DCF-22

Evidence Library Page -> Document with the type Network diagram and creation date within audit time period.

DCF-26

Evidence Library Page -> Document with the type BCP/DR and creation date within audit time period.

DCF-46

Setting -> HR -> Sample employment agreement

DCF-47

Sample job description from HR page

DCF-56, 57, 129, 132

Generate a .zip containing all the vendors with their attached evidence - No date limitations.

DCF-64

Setting -> Company Info -> Sample MSA

DCF-65

Setting -> Company Info -> Privacy policy URL

DCF-66

Setting -> Company Info -> Terms of Service URL

DCF-145

Setting -> Key Personnel Info -> Board of directors CSV

Note: To learn more about how the Control Evidence Package is generated, and how to see updated evidence, go to this Audit Hub help article, and scroll down to the "The Auditor can also have additional functionality that allows them to:" section.

Did this answer your question?