Get evidence for an audit

[ Applies to ] StorageGuard 10.1 and later  /  All supported storage, backup, SAN and cloud systems  /  Windows and Linux deployments

Auditors don't take a green checkmark on trust. They want to see the configuration that proves a control is in place, on each system, with a date. StorageGuard keeps that evidence from every scan: the exact command output or API response the check evaluated. This article shows how to find it for one check, and how to export it for a whole standard.

See the evidence for one check

1. On the Compliance tab, double-click the check.
2. The detailed view lists every system in scope with its result, Pass or Fail, and the finding ID for failures.
3. Click the Evidence icon for a system to see the configuration snippet the check evaluated: the command that was run and its output, or the API response.

The header shows the principle the check validates, its category, the system type, and the check parameters it used, such as the minimum TLS version. Together with the evidence, that's the complete chain from requirement to proof.

Export evidence for a standard

The Configuration Compliance report exports every check for the systems and policies you choose, with the pass or fail status and the evidence, to an Excel-friendly file.

1. Go to Reports > Catalog and click Configuration Compliance.
2. Set the parameters: System Types, Sites, Security Policies, and Check Results (all, or only passes or failures).
3. Keep Include evidence selected to attach the configuration snippets.
4. Select Choose Analysis Dates to report on a specific analysis, for example the one that closed the audit period.
5. Select Sanitize report if the evidence may contain values you don't want to share, such as internal IP addresses or user names.
6. Click Generate, then the Share icon, and choose the file type.

Export pass/fail per system

The Analysis Summary report gives a pass/fail summary with evidence per check, for the systems you select. Use it when the audit scope is a set of systems rather than a standard, for example all systems in one data center. Run it from the same catalog.

Prepare for the audit

• Run a fresh scan and analysis just before you export, so the evidence carries the audit date. See Run and schedule a risk analysis.
• Clear the unknowns. Systems with Insufficient Information or Missing user input will be questioned. See Deal with checks that couldn’t be evaluated.
• Document exceptions. For each suppressed check or finding in scope, the suppression note should state the exception and who approved it. See Review and audit tuning.
• Schedule the report. For recurring audits, schedule the Configuration Compliance report to run at End of Security Risk Analysis and save it to a folder, so every period's evidence is kept.

Related articles

• Check compliance with a standard
• Share findings
• Tune risk detection