Compliance in practice: controls, evidence and audits

Audits are painful when evidence is gathered by panic in the last week. They are routine when controls have owners and evidence is produced automatically all year.

GRC platforms (Vanta, Drata, OneTrust)policy-as-codecloud config and audit logsticketing systemsevidence repositoriesinternal audit

From requirement to control

Requirement: what a standard or law demands, in its own words.
Control: what you actually do to meet it, written so that it can be tested (who, what, how often).
Owner: the person accountable for the control working, not the compliance team.
Evidence: proof that the control operated during the period, such as a configuration export, a log, a ticket, an approval.
Test: a periodic check that the control works, by its owner and by independent review.

Continuous evidence

Wherever a control is technical, let the system produce the evidence. Version-controlled policy, configuration and access reviews leave a trail by design.

collect-evidence.shbash

DATE=$(date -u +%F)
mkdir -p evidence/$DATE

# who has admin access to the cloud account
aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess \
  > evidence/$DATE/aws-admin-principals.json

# is MFA enforced for console users
aws iam generate-credential-report >/dev/null && aws iam get-credential-report --query Content --output text \
  | base64 -d > evidence/$DATE/iam-credential-report.csv

# branch protection on the main repository
gh api repos/example/app/branches/main/protection > evidence/$DATE/branch-protection.json

sha256sum evidence/$DATE/* > evidence/$DATE/SHA256SUMS

The audit

Scope and period are agreed first; know what is in and out.
Auditors ask for a sample of evidence for each control. Organize it by control, with names and dates that make sense.
Be honest about exceptions: a documented gap with an action plan is far better than one the auditor finds.
Findings become entries and tracked work with owners and dates.
Keep one point of contact and a calm cadence; surprise requests usually mean missing evidence.

Avoiding checkbox security

Ask of each control what risk it reduces. If nobody can say, question it.
Prefer automated checks over screenshots and annual attestations.
Use one control to satisfy several frameworks instead of one process per standard.
Share the compliance calendar with engineering so that requests are planned work, not interruptions.

Risk registerThe working record of identified risks: owner, rating, controls, treatment, actions and review date.see in glossary →

connections on the map

Security frameworks and standardsis evidenced byCompliance in practice: controls, evidence and audits
Security architecture principlesmakes evidence automaticCompliance in practice: controls, evidence and audits
Compliance in practice: controls, evidence and auditssupplies data toSecurity metrics and reporting to leadership

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Policy as codesecengautomatic evidence comes from executable policy

Study before

Security frameworks and standards

test what you learned

Loading questions…