ACSETalk to us
  1. Home
  2. Learn
  3. Compliance evidence

Guide

Compliance evidence that holds up

Auditors don’t only ask whether a control is met today. They ask how you know, whether a change was authorized, tested and reversible, and whether the record could have been altered. Good evidence answers those questions without anyone having to vouch for it.

Talk to usSee how it works
Audit packages from sealed casesSealed cases stack into an audit package organized per framework control.AUDIT PACKAGESEALED CASESpci dss 4.0.1 · q3 · per control
01

Tell status from evidence

A screenshot shows a moment. Evidence shows what happened, who decided and how it was checked.

02

Report honestly

Keep the cloud’s own result separate from what your team has accepted or excluded.

03

Shorten the audit

Evidence an auditor can verify alone needs fewer meetings and fewer samples.

Status versus evidence

A dashboard is not a record

Frameworks such as PCI DSS, SOC 2 and ISO 27001 ask you to show that controls operate over time. For a change to a regulated system, an auditor typically asks three things: was it authorized, was it tested, and could it be undone?

A posture dashboard answers none of them. It shows current state. Evidence is the trail behind that state: the finding, the proposed change, the tests, the decision and the verification, each tied to the next.

Controls mapped to checksA layer of framework controls for PCI DSS, NIST, ISO, SOC 2 and CIS sits above the layer of checks that evaluate them; one failing check is traced to the control it affects.PCINISTISOSOC 2CISCONTROLSeach framework versioned and signedCHECKSone check can satisfy many controls

What makes evidence hold up

Four properties to look for

01

Complete

Every step from finding to verification is recorded, including decisions not to act.

02

Attributable

Each decision names who made it and how they proved who they were.

03

Tamper-evident

Any change, removal or reordering of a record is detectable.

04

Independently verifiable

An auditor can check it without trusting the system that produced it.

Two scores

Raw and governed, side by side

A raw score is what the cloud reports, never adjusted. A governed score counts what your team has handled: attested controls and approved exceptions count as handled, and exclusions leave the total. Showing both keeps a better governed score from hiding what the cloud says.

Example tenant · 120 controls

77%

Governed: what your team has handled

  • 84 pass
  • 4 accepted exceptions count as handledcount as fail
  • 3 attested by a person count as handledcount as unknown
  • 2 excluded out of the totalcount as fail
  • 20 fail
  • 7 unknown never counted as pass

Both scores are always shown together, so a better governed score can never hide what the cloud reports. Illustrative numbers.

How ACSE approaches it

Every step leaves a signed record

  1. Recorded as it happensThe finding, the fix, its validation, the guardrail verdict and the decision are each written as a record.
  2. Chained and signedEach record holds the hash of the one before and is signed, so changes and gaps are detectable.
  3. Kept in your accountRecords go to write-once storage in your own cloud. Decisions made in the portal are delivered back and chained before they count.
  4. Sealed after observationAfter the fix is verified and watched through its observation window, the case is sealed.
  5. Verified offlineAn auditor checks an exported case with no ACSE account. Two independent verifiers must agree.
The record lives with youRecords for a finding, the proposed fix, the decision, the merge and the verification are chained, each holding the hash of the one before, and written to append-only storage in the customer’s own account.YOUR ACCOUNTobject lock · append-onlyfindingproposaldecisionmergeverifiedeach record holds the hash of the last

For the audit

Packages organized by control

ACSE assembles audit packages from sealed cases, organized by framework control. A control ACSE can’t evaluate, for example because its check is turned off, reads not evaluated and counts as unknown, never as met.

  • Framework reports with raw and governed scores
  • Attestations and exclusions approved by a second person
  • Case exports any auditor can verify
Verified offlineAn auditor opens a case bundle on their own machine with no network and no ACSE account. The verifier confirms the chain, the signatures and the seal, and two independent verifiers agree.CASE BUNDLEacse-verify bundle.zip✓ chain intact✓ signatures valid✓ seal validpython and typescript agreeno network · no acse account

Questions

What people ask us

Why not just report one score?

A single blended score can rise because risks were accepted, not because anything was fixed. Showing the raw score beside the governed one keeps both facts visible.

What does tamper-evident mean here?

Each record contains the hash of the record before it. Changing or removing any record breaks every hash after it, and a verifier reports exactly where.

Does my auditor need an ACSE account?

No. They verify an exported case on their own machine, offline. See ACSE for auditors.

Keep reading

Related

Platform

Evidence

ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.

ReadSolutions

Auditors

Verify ACSE evidence offline with an open verifier and no ACSE account: a signed, hash-chained record of who approved each change and how it was tested.

ReadSolutions

Audit readiness

ACSE builds audit evidence as your team works: sealed cases, packages organized by control and a signed chain your auditor can verify offline on their own.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform