Compliance evidence
Evidence an assessor can check, with its limits written on it
Export a control-tagged pack that says, for each control, what the register proves and what it does not. It is built against ISO 27001 Annex A and Cyber Essentials, and it is useful for the Cyber Resilience Act and customer due diligence.
What the register evidences
These are the controls the pack is organised around today. The claim column is deliberately narrow and covers only what the data supports, which is often less than everything the control asks for.
| Control | What the register holds |
|---|---|
| ISO 27001 A.5.9 Inventory of assets | Every device and every software component, with owner, classification and lifecycle state, reconstructable for any past date. |
| A.5.11 Return of assets | What each custodian still holds, including kit in repair or recorded lost, and the record of its return. |
| A.5.12 Classification of information | A data classification per asset, and the corrections made to it with reasons. |
| A.5.19–A.5.23 Supplier relationships | Components by supplier and licence, with policy verdicts and attributable waivers. |
| A.8.1 User endpoint devices | Disk-encryption state per endpoint, counted over the endpoint population specifically, with "never recorded" reported as a gap and never as a pass or a failure. |
| A.8.8 Management of technical vulnerabilities | Findings per deployed release, the position taken on each, who approved it, and when a human was alerted. |
| A.8.15 Logging | Every change to the register is written to a hash-chained, append-only log with the previous value, the new value, who made the change, when, and the request it came in on. You can verify the whole chain yourself. |
| Cyber Essentials CE.3 / CE.4 | How long known vulnerabilities have been outstanding on deployed releases, and every credential issued, its scopes, expiry, last use and revocation. |
What this contributes to each framework
No tool makes an organisation compliant with anything. A register can answer a specific control with evidence somebody else can check. This page shows which controls that covers.
| Framework | What the register contributes | What it does not |
|---|---|---|
| ISO/IEC 27001 Annex A | A control-tagged evidence pack covering the asset inventory controls, ownership, classification, return of assets, supplier records, endpoint encryption state, technical vulnerability management and logging. | Your ISMS, your risk treatment plan or the certification itself. It answers the inventory half of an audit. It does not cover the management system around that inventory. |
| Cyber Essentials | The device inventory, the encryption state per endpoint, and how long a known vulnerability has been outstanding on something you run. | Firewall, malware and access-control questions, which are not inventory facts and are not recorded here. |
| EU Cyber Resilience Act | A retained SBOM per release for products with digital elements, and the vulnerability position taken on each component over the product's supported life. | Conformity assessment, CE marking, or your reporting obligations to authorities. |
| NIS 2 | Supply-chain security evidence: what your services are built from, which suppliers' components you depend on, and the record of how an exposure was handled. | Incident reporting timelines, governance and management accountability. These are duties of the organisation and sit outside the register. |
| DORA | The ICT asset register and the third-party component dependency picture underneath a financial entity's critical services. | The register of information in its prescribed reporting format, contractual arrangements, or resilience testing. |
| SOC 2 | Population evidence for change management and vulnerability management criteria: what exists, what shipped, when, and who approved a position on a finding. | The audit itself, the other trust services criteria, and any opinion. There is no SOC 2 report template here. |
If a framework is not listed here, nothing in provenance is shaped for it. Nothing on this page asserts certification, accreditation or an assessor's opinion.
Three things that make it evidence
- The export is itself recorded. Each pack is logged with the digest of the bytes produced. The pack itself is not kept, but its log entry is, and you can use it to show which version you sent the auditor in March.
- Counts state their population. Every figure says whether it counts the working set or the whole record, and whether it counts endpoints or all assets. Without that, two readers can read the same figure differently.
- Unknowns are labelled unknown. A release with no SBOM produces no findings, and provenance reports it as unknown, never as clean. An encryption state that nobody has checked is reported as a gap, never as a pass.
Compliance questions
Does this make us ISO 27001 certified?
No, and no tool can. Certification is an audit of your management system by an accredited body. provenance holds the evidence several Annex A controls ask for, in a form an assessor can check, and states for each control what the register proves and what it does not.
What is in an evidence pack?
The pack is organised by control reference. Each section states what the register evidences for that control, the limits of that claim and the queries behind the figures. You can export it as JSON for a pipeline, as printable HTML or as a PDF for an audit file. Every export is recorded in the audit log with the digest of the bytes produced.
Why does every control carry a caveat?
An assessor will find any claim the pack cannot support, and an overclaiming pack does more harm than none. Each claim therefore carries its limit, which also tells a reviewer what other evidence they will need.
Does it help with the EU Cyber Resilience Act?
It holds the parts the CRA asks a manufacturer to keep: a bill of materials for products with digital elements, a record of known vulnerabilities and the positions taken on them, and a durable trail of when each was learned and handled. It is not legal advice and does not assess conformity.
Can an auditor verify the record independently?
Yes. The audit log is hash-chained, and the service publishes the exact fields each digest covers together with the whole log in genesis order, so the chain can be recomputed outside the platform. Breaks are annotated and never repaired, since repairing one is exactly what the chain is designed to detect.
Take a pack to your next audit
Pick the scheme, or the individual controls an assessor asked about, and export.