Reuse & packs
A registered item earns its place when it is connected to the things it proves. This page covers linking evidence to controls, how approved questionnaire answers become evidence, sealing items so your auditor can use them, and evidence packs.
Link evidence to controls
Linking is what turns an artifact into coverage, and it starts from the control. In Assessments, click Click to link evidence or drag here on a control card, or use Attach evidence on a requirement in a framework's control tree. Link Evidence to Control opens with two tabs: Pick existing and Upload new. Choose the evidence, a Link Type (Manual or AI Suggested), and an Evidence Strength (Weak, Moderate, Strong, or Definitive), add notes if you like, and click Link Evidence. Upload new registers a new file and links it in one step.
To add more links to evidence that is already linked somewhere, use Link to Control in a row's menu on the Assessments Evidence tab. It opens Link Evidence to Controls, where you pick a framework, several controls, and a link strength.
Once linked, the relationship is visible from both ends. The evidence item's Details tab lists its Linked Controls, each with its reference, its framework, its validation status, and its link type, and the Evidence Library's Controls column shows how many controls each item covers. The control shows the evidence backing it. Linking does not change a control's status by itself; see Assess controls.
Link the same item everywhere it genuinely applies. Frameworks overlap heavily, and a single strong artifact — an access-review export, a pen-test report — often satisfies sibling requirements across several activated frameworks. Links are not copied between frameworks, so link it in each one.
Evidence from approved answers
Approving a questionnaire answer in the Review Center registers it in the Evidence Library automatically, as an attestation titled "Questionnaire Answer: questionnaire name". The exception is an answer approved over an open check, which you register with Register as evidence. Once registered, an answer is ordinary evidence: quality-scored and linkable to controls.
Separately, answers approved in the past year are used as reference wording when the AI drafts future questionnaires. The full flow is covered in the Questionnaires guide: Register evidence & export.
Seal evidence for release
Sealing releases an item to your external auditor. A sealed item can be attached to an audit's evidence requests and downloaded from the auditor portal; an auditor sees only the items attached to their engagement's requests. Unsealed evidence stays internal.
In the Evidence Library, seal an item with the lock action on its row (Seal — release to external auditors). Unseal withdraws it again. The Release column shows Sealed or Internal, and sealing needs update permission. A file a vendor uploaded cannot be sealed while its malware scan is pending, or if the scan flagged it. Files uploaded straight into an audit request are sealed for you.
Seal an item when it is final and you intend an auditor to see it. Unsealing withdraws it from external release again, so the decision stays in your hands: sealed means "this is the version we are standing behind."
The Evidence Library shows your 50 most recently registered items, and its search covers only those.
Build an evidence pack
From the Review Center, Create Evidence Pack bundles the evidence a questionnaire produced into a named pack. Name it, pick a pack type — Audit Response, Certification, Assessment, Incident Report, or Custom — add an optional description, and move items up to set their order.
There is currently no screen to seal, export, or list packs, and packs are not connected to audits.
Hand evidence to an auditor
An audit takes evidence through its requests. Seal the items, attach them to the audit's evidence requests, and your auditor reviews and downloads them in the auditor portal. When fieldwork is done, freeze the audit and export an evidence package with its manifest. See Run an engagement and Auditor room and export.
That is the full evidence lifecycle: files in, quality and freshness watched, links to controls doing the daily work, and sealed items answering your auditor's requests. Start again at the Overview for the map, or jump to any stage from the sidebar.