> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

> Organization: Acme Inc Log Owner: Jane Mueller Contact: legal@acme.com Last Updated: 2026-03-19 Next Review: 2026-06-19 Services in Scope: 8

> Disclaimer: This evidence log is auto-generated from code analysis and should be reviewed by your compliance team. It provides a starting framework for audit evidence tracking but must be customized to your specific audit scope and requirements.

## Summary

Metric | Value
--- | ---
Total Controls | 23
Evidence Collected | 16
Evidence Pending | 7
Not Applicable | 0
Completion Rate | 70%

## SOC 2 Evidence

Control ID | Control | Evidence Type | Description | Location | Status | Reviewer
--- | --- | --- | --- | --- | --- | ---
CC1.1 | Organizational Commitment to Integrity | Document | Code of conduct, ethics policy, and employee acknowledgment records | legal/COMPLIANCE_OATH.md, HR records | Pending | Jane Mueller
CC1.2 | Board Oversight | Document | Board meeting minutes documenting compliance oversight | legal/COMPLIANCEBOARDREPORT.md | Pending | Jane Mueller
CC2.1 | Internal Communication | Document | Security awareness training records and communication plan | legal/SECURITYAWARENESSPROGRAM.md, legal/COMPLIANCECOMMUNICATIONPLAN.md | Collected | Jane Mueller
CC3.1 | Risk Assessment Process | Document | Risk register covering 8 detected service(s) and third-party risk assessments | legal/RISKREGISTER.md, legal/THIRDPARTYRISKASSESSMENT.md | Collected | Jane Mueller
CC5.1 | Logical Access Controls | Configuration | Access control policy and authentication service configuration (detected auth services) | legal/ACCESSCONTROLPOLICY.md, auth service config | Collected | Jane Mueller
CC5.2 | Data Protection Controls | Configuration | Encryption-at-rest and in-transit configurations for detected database services | legal/ENCRYPTION_POLICY.md, database config | Pending | Jane Mueller
CC6.1 | Access Provisioning | Log | User access review logs and provisioning/de-provisioning records | IAM system logs, HR records | Pending | Jane Mueller
CC7.1 | Vulnerability Management | Log | Vulnerability scan results and remediation tracking | legal/PENETRATIONTESTSCOPE.md, scanner reports | Pending | Jane Mueller
CC7.2 | System Monitoring | Screenshot | Monitoring dashboard screenshots and alerting configuration | Monitoring service console, alert config | Collected | Jane Mueller
CC8.1 | Change Management Process | Document | Change management policy and recent change request records | legal/CHANGEMANAGEMENTPOLICY.md, Git history | Collected | Jane Mueller
CC9.1 | Incident Response | Document | Incident response plan and post-incident review records | legal/INCIDENTRESPONSEPLAN.md, incident logs | Collected | Jane Mueller
AI-1 | AI Governance | Document | AI governance framework, model cards, and impact assessments | legal/AIGOVERNANCEFRAMEWORK.md, legal/AIMODELCARD.md, legal/AIIMPACTASSESSMENT.md | Collected | Jane Mueller
PCI-1 | Payment Data Handling | Configuration | PCI DSS self-assessment questionnaire and payment service configuration | Payment provider dashboard, legal/DATAFLOWMAP.md | Pending | Jane Mueller
PRIV-1 | Consent Management | Configuration | Cookie consent configuration and consent record evidence | legal/COOKIECONSENTCONFIG.md, legal/CONSENTMANAGEMENTGUIDE.md | Collected | Jane Mueller

## ISO 27001 Evidence

Control ID | Control | Evidence Type | Description | Location | Status | Reviewer
--- | --- | --- | --- | --- | --- | ---
CC3.1 | Risk Assessment Process | Document | Risk register covering 8 detected service(s) and third-party risk assessments | legal/RISKREGISTER.md, legal/THIRDPARTYRISKASSESSMENT.md | Collected | Jane Mueller
CC5.1 | Logical Access Controls | Configuration | Access control policy and authentication service configuration (detected auth services) | legal/ACCESSCONTROLPOLICY.md, auth service config | Collected | Jane Mueller
CC5.2 | Data Protection Controls | Configuration | Encryption-at-rest and in-transit configurations for detected database services | legal/ENCRYPTION_POLICY.md, database config | Pending | Jane Mueller
CC7.1 | Vulnerability Management | Log | Vulnerability scan results and remediation tracking | legal/PENETRATIONTESTSCOPE.md, scanner reports | Pending | Jane Mueller
CC7.2 | System Monitoring | Screenshot | Monitoring dashboard screenshots and alerting configuration | Monitoring service console, alert config | Collected | Jane Mueller
CC8.1 | Change Management Process | Document | Change management policy and recent change request records | legal/CHANGEMANAGEMENTPOLICY.md, Git history | Collected | Jane Mueller
CC9.1 | Incident Response | Document | Incident response plan and post-incident review records | legal/INCIDENTRESPONSEPLAN.md, incident logs | Collected | Jane Mueller
A.5.1 | Information Security Policy | Document | Information security policy document and management approval | legal/INFORMATIONSECURITYPOLICY.md | Collected | Jane Mueller
A.6.1 | Security Roles and Responsibilities | Document | Defined security roles, RACI matrix, and contact information | legal/SECURITY.md, legal/KEYPERSONRISK_ASSESSMENT.md | Collected | Jane Mueller
A.8.1 | Asset Inventory | Document | Inventory of 8 detected service(s) including data classification | legal/DATADICTIONARY.md, legal/DATAFLOW_MAP.md | Collected | Jane Mueller
A.10.1 | Cryptographic Controls | Configuration | Encryption policy and key management procedures | legal/ENCRYPTION_POLICY.md | Pending | Jane Mueller
A.12.4 | Logging and Monitoring | Log | Audit log policy and sample logs demonstrating retention | legal/AUDITLOGPOLICY.md, system logs | Collected | Jane Mueller
A.14.1 | Secure Development | Document | Secure development lifecycle documentation and code review evidence | legal/PRIVACYBYDESIGN_CHECKLIST.md, Git PR history | Collected | Jane Mueller
A.15.1 | Supplier Security | Document | Supplier risk assessments, DPAs, and vendor onboarding records | legal/VENDORONBOARDINGCHECKLIST.md, legal/THIRDPARTYRISK_ASSESSMENT.md | Collected | Jane Mueller
A.16.1 | Incident Management Process | Document | Incident severity matrix, communication templates, and drill records | legal/INCIDENTSEVERITYMATRIX.md, legal/DATABREACHRESPONSE_DRILL.md | Collected | Jane Mueller
A.18.1 | Legal and Regulatory Compliance | Document | Regulatory mapping and compliance gap analysis | legal/REGULATORYMAPPINGMATRIX.md, legal/COMPLIANCEGAPANALYSIS.md | Collected | Jane Mueller
AI-1 | AI Governance | Document | AI governance framework, model cards, and impact assessments | legal/AIGOVERNANCEFRAMEWORK.md, legal/AIMODELCARD.md, legal/AIIMPACTASSESSMENT.md | Collected | Jane Mueller
PCI-1 | Payment Data Handling | Configuration | PCI DSS self-assessment questionnaire and payment service configuration | Payment provider dashboard, legal/DATAFLOWMAP.md | Pending | Jane Mueller
PRIV-1 | Consent Management | Configuration | Cookie consent configuration and consent record evidence | legal/COOKIECONSENTCONFIG.md, legal/CONSENTMANAGEMENTGUIDE.md | Collected | Jane Mueller

## Evidence Collection Schedule

Frequency | Activity | Responsible | Due
--- | --- | --- | ---
Weekly | Review access logs and monitoring alerts | Jane Mueller | Every Monday
Monthly | Update vulnerability scan results | Jane Mueller | 1st of month
Monthly | Review change management records | Jane Mueller | 1st of month
Quarterly | Full evidence collection review | Jane Mueller | 2026-06-19
Quarterly | Vendor/supplier compliance check | Jane Mueller | 2026-06-19
Annually | Complete re-assessment of all controls | Jane Mueller | 2026-03-19 + 1yr
Quarterly | AI model governance review | Jane Mueller | 2026-06-19
Annually | PCI DSS self-assessment update | Jane Mueller | 2026-03-19 + 1yr

## Evidence Quality Checklist

For each evidence item, verify:

- Evidence is dated and timestamped
- Evidence covers the full audit period
- Evidence is from the production environment
- Evidence is stored in a tamper-evident location
- Evidence has been reviewed by the assigned reviewer
- Evidence clearly maps to the stated control objective
- Supporting screenshots include system date/time
- Configuration evidence shows both policy and enforcement

## Services in Scope

The following services were detected during code scanning and are in scope for audit evidence:

Service | Category | Data Collected
--- | --- | ---
@sentry/node | monitoring | error data, stack traces, user context, device information, IP address
@supabase/supabase-js | auth | email, password hash, session data, user metadata
openai | ai | user prompts, conversation history, generated content
posthog | analytics | user behavior, session recordings, feature flag usage, device information
prisma | database | user data as defined in schema
resend | email | email addresses, email content
stripe | payment | payment information, billing address, email, transaction history
stripe-ios | payment | payment information, billing address, email, transaction history

Generated by Codepliant on 2026-03-19. This evidence log should be reviewed and updated regularly by your compliance team. Consult with your auditor to confirm evidence requirements specific to your audit scope.