Skip to main content
All CollectionsEvidence Library
Evidence Library
Evidence Library

Streamline evidence collection by mapping evidence across multiple controls, maintaining version history, and preparing control readiness.

Updated over a week ago

Drata's Evidence Library represents a repository for all the evidence you need to collect across all your controls

Drata's Evidence Library page is already filled with pieces of evidence that are mapped to your controls. These evidences are commonly requested by auditors and can be helpful for you in preparing for an audit or simply achieving and maintaining compliance.

If any of these pieces of evidence don’t pertain to your organization, you can either delete them (one at a time or in bulk) or unlink them from the control.

Note: These pre-mapped evidence is only available for customers with either SOC2 or ISO27001:2022, and who joined Drata after 8/27/2024.

Evidence overview

Each evidence has the following sections: Details, Artifact, and Linked Control.

Details section

The details section is where you can add a name, description, implementation guide, and owner for the evidence. These are the key details of an evidence for future reference or to collaborate with other colleague in uploading what is needed to fulfill the evidence.

Artifact section

The artifact is what fulfills the evidence requirement. After creating the evidence, you can upload an artifact or source to fulfill the evidence requirement and enter the creation and renewal date. The following source options are:

  • No artifact: Select this option if you would like to fulfill the evidence requirement at a later time.

  • File: Select this option if you are uploading a file from your computer or from a cloud provider.

    • Ensure that each uploaded file does not exceed 25 MB. If you're uploading a zipped file, it will be unzipped and verified to confirm that each file does not exceed the 25 MB limit.

  • URL: Select this option if the evidence itself is represented by a URL, or if the evidence is sensitive in nature (such as containing government data). You can add a link to the artifact that exists in a secure system.

  • Ticketing provider: Select this option if the evidence is represented by a ticket within a connected ticketing provider.

Linked controls section

Here, you can indicate what controls applies to the evidence. There are many-to-many relationship between evidence and controls, so one evidence can apply to many controls.

Evidence status and control readiness

There are 4 statuses for evidence. Here’s what each status means and how it applies to control readiness:

Status

Status definition

Control readiness

No Artifact

Evidence does not have an artifact.

Can negatively impact control readiness.

Ready

Evidence contains an artifact and the renewal date has not passed.

Can positively impact control readiness.

Upcoming renewal

Evidence contains an artifact and renewal date is within the next 2 months.

Can positively impact control readiness.

Past Renewal

Evidence contains an artifact but renewal date has past.

Can negatively impact control readiness.

Evidence versions

When you update your evidences, you can view the past versions or previously updated evidences as well. This is so that you do not lose the history of the evidences you placed over time. A few things to keep in mind while managing versions:

  • You can always look at past versions of the artifact uploaded to your evidence.

  • Only the current version of the artifact has an influence over control readiness and the overall evidence status.

  • A previous version of evidence cannot be brought back as the current version.

  • Previous version can be deleted, but the current version cannot.

Add evidence

Note: Ensure that each uploaded file does not exceed 25 MB. If you're uploading a zipped file, it will be unzipped and verified to confirm that each file does not exceed the 25 MB limit.

You can either upload evidence directly from your machine, or link a preferred cloud file provider.

  • Supported file types for direct upload: .pdf, .docx, .odt, .xlsx, .ods, .pptx, .odp, .gif, .jpeg, .jpg, .png, .md, .zip, .txt, and .csv.

  • Available cloud file provers: Google Drive, Microsoft OneDrive, Sharepoint, Okta Box, and Dropbox.

    • Supported extensions for the cloud storage: .pdf, .docx, .odt, .xlsx, .ods, .pptx, .odp, .gif, .jpeg, .jpg, .png, and .csv.

  • Maximum file size allowed for zip file is 100MB and 25MB for other formats.

To add evidence in Evidence Library:

  1. Navigate to Evidence Library page. You should be able to select Evidence Library on the left side navigation.

  2. Select Add Evidence.

  3. In the next steps, enter a Name, Description, Owner, and Artifact.

    • The Artifact section is where you can add a URL, upload a file, or indicate that this item does not need an artifact.

  4. To upload a file, under the Artifact sections select File from the Source dropdown options.

  5. Then, select Attach file.

    • Note: Ensure that each uploaded file does not exceed 25 MB. If you're uploading a zipped file, it will be unzipped and verified to confirm that each file does not exceed the 25 MB limit.

  6. You can either upload evidence directly from your machine, or link a preferred cloud file provider.

    • Select the desktop icon () to upload evidence directly from your machine, or

    • Select the desired cloud provider icon to link to that provider.

    • If you selected Google as your cloud provider:

      • Allow Drata to access See your Google Drive labels to view the labels in Evidence Library. If you do not allow this, the labels are not viewable in Evidence library.

    • If you selected Microsoft OneDrive, ensure to log into your preferred work account using the right credentials.

    • If you selected OneDrive and more than one Drive associated with the account, ensure to select the preferred drive from the Drive dropdown menu.

  7. For those that linked a cloud provider: After linking the provider, you can browse all the files from your account directly from Drata. You search thru the search icon to find your files or folders with keywords.

  8. Once you’ve uploaded a file, enter the Creation date and Renewal date.

  9. Optionally, you can link the evidence to controls by selecting on Link control. Then, you can search and select the controls you want to link the evidence to.

    • You can unlink a control by expanding the control tile and clicking the Unlink icon.

  10. Once you select Save, the evidence will be created and linked to the respective controls in Drata.

Add Evidence from the Control page

  1. Navigate to the Controls page and select a control.

  2. On the control drawer, scroll down to the Control Evidence section. Select Add in the Evidence Library section.

  3. Select Add Evidence.

  4. Enter the evidence details, upload a file or URL, and optionally link other controls.

  5. Save your changes. You will be taken back to the control drawer. Any changes made within the control drawer will also be synced to Evidence Library.

View Evidence

On the Evidence Library page, there is a table of evidences. You can also filter the table based on statuses. The statues are: Ready, Upcoming renewal, Past renewal, Needs artifact. You can also search for evidences by name or linked controls.

Select anywhere on the evidence row or the Update button to update the evidence details.

You can also view the past evidences if there are any. Under the Artifact section, if you have updated your evidence, the previous evidences will save as past versions. The associated creation date and renewal date for all versions will be shown.

Select View to view more information or Remove to remove the previously updated evidence.

If there is no previous evidences uploaded or updated, that will be indicated.

View evidence from the Control page

  1. Navigate to the Controls page and select a control.

  2. On the control drawer, scroll down to the Control Evidence section. Expand the Evidence Library section. Here you can view, edit, or unlink the attached evidence.

    • Edit evidence: Select the update icon () to make any edits.

      • You can select on Back to DCF-XX to go back to the control drawer.

      • If you have made changes, ensure to save your changes and you are redirected back to the control drawer.

      • You can also cancel any changes you made. Any changes made within the control drawer will also be synced to Evidence Library.

    • View evidence: Select the view icon () to view the evidence in a new tab.

    • Unlink evidence: Select the the unlink icon () to unlink the evidence from the control.

Update evidence

  1. Navigate to Evidence Library page. You should be able to select Evidence Library on the left side navigation.

  2. Select the desired evidence.

  3. On the evidence drawer, scroll down to the Artifact section and select Update.

  4. If you upload a new file from your computer, enter a new creation and renewal date.

  5. You can edit any part of the evidence details as well. Once you’re ready, ensure to save your changes.

    • You can view all of the past versions of uploaded evidences within the Artifact section.

    • Only the current version of evidence is linked to the controls.

Delete evidence

⚠️ Warning: Deleting evidence is a permanent action. The evidence will be removed and deleted from all linked controls.

  1. Navigate to Evidence Library page. You should be able to select Evidence Library on the left side navigation.

  2. Select an evidence you want to delete in Evidence library.

  3. On the evidence drawer, select the trash icon at the top.

Did this answer your question?