What's Actually Inside an Evidence Package (And Why Auditors Ask for One)
An auditor reviewing your security posture doesn't want to be handed a login and told to click around. They want something they can file, reference, and hand to their own reviewers, self-contained, timestamped, and not dependent on a tool still existing or an account still being active six months from now. Evidence Packages, available on Decloak Pro, are built to be exactly that.
What it actually is
An Evidence Package is a single ZIP export covering a date range you choose, containing every scan run against a domain in that window, formatted specifically for auditor handoff rather than for you to read day to day.
Inside, you'll find:
- Every PDF report generated in the date range, timestamped and formatted individually, exactly as they'd have looked if exported at the time.
- Finding logs, a structured record of what was found, when, and at what severity, across every scan in scope, not just a snapshot of the most recent one.
- Scan attestation metadata, the audit trail data confirming who triggered each scan, when, and under what configuration, the chain-of-custody detail an auditor actually needs to trust that the evidence wasn't cherry-picked or altered after the fact.
Why a date range, not just "the latest scan"
A single scan proves your posture on one day. An auditor evaluating a SOC 2, ISO 27001, NIS2, or DORA claim usually cares about a period, did you monitor consistently across the quarter, did findings get addressed, was there ongoing evidence of a working process rather than a scramble the week before the audit. A date-range export answers that question directly: it shows the actual history, including anything that looks less polished than a single cherry-picked scan would.
How it fits with the rest of your compliance workflow
Evidence Packages sit alongside a few other Pro features that are designed to work together rather than in isolation:
- Compliance control mapping tags every finding to the relevant SOC 2, ISO 27001, NIS2, or DORA control, so the evidence you're exporting is already organized the way an auditor thinks about it, not just a raw list of technical findings.
- White-label branding carries through into every PDF inside the package, so an evidence bundle handed to a client by an agency or consultant looks like it came from them, not from a third-party tool they happen to use.
- Remediation tracking (Open, In Progress, Resolved, Accepted Risk) means the finding logs inside a package show not just what was found, but what happened to it, which is often exactly what an auditor is checking for: evidence that findings get acted on, not just detected.
When to actually generate one
A few common triggers worth knowing:
- Ahead of a scheduled audit. Generate the package covering the full period the audit will review, well before the auditor asks, rather than scrambling to reconstruct history from memory.
- After closing out a significant remediation effort. A package generated right after a batch of findings gets marked Resolved gives you a clean before-and-after record.
- As a standing quarterly habit, especially if you're running scheduled recurring scans, which pairs naturally with a quarterly Evidence Package export as a rhythm rather than a one-off scramble.
Availability
Evidence Packages are available on Decloak Pro and above, exportable for any date range covering scans already in your account's history.
Evidence Packages are available on Decloak Pro. See plans →