Attestations and evidence

Overview

Automated checks cover the controls DeviceQuest measures. For the remaining controls, and for gaps you decide to live with, you record a decision: a sign-off (attestation) backed by evidence files, or an applicability decision that takes a control out of scope. All of this happens in the control record. The Evidence tab then lists every file for the framework, and the Statement of Applicability export gives your auditor the full scope decision.

The control record

Open a control from the Controls tab of Compliance: click its row, its View button, or Open full control record in the expanded row. You can also click a bar in Control posture or a control ID in Framework crosswalk. The record opens as a side sheet.

Click to enlarge

Close the record with ×, x or Esc. The record’s address contains the control, so you can share a link straight to it.

Affected assets

The Affected assets (n) panel lists up to 25 assets, grouped by reason, each with a suggested fix:

Click an asset name to open the asset. When a finding applies to the whole tenant rather than to specific assets, the panel says so.

Mark a control as not applicable

Exclude a control when it does not apply to your organization, for example a wireless control in an estate with no wireless networks. An excluded control keeps its status but drops out of every count, and your justification goes into the Statement of Applicability.

Click to enlarge

1. Open the control record.
2. Under Applicability, click Mark not applicable.
3. Enter the reason in Why doesn’t this control apply?. If you leave it empty, the form shows A reason is required.
4. Click Mark not applicable.

The Applicability section then shows Excluded · reviewed {time}, your justification, and Decided {date} by {name}.

Review an exclusion

Review every exclusion at least once a year. When the last review is more than 365 days old, the section adds — due for review.

• Click Still correct to confirm the decision. This records today as the review date and keeps the justification.
• Click Mark applicable again to bring the control back into scope.

Every applicability change is written to the audit log.

Attest a control

A sign-off records a decision, attributed to you, about a control:

• On a monitored control that fails or needs attention, a sign-off backed by evidence records formal acceptance of the gap. The control then reads Accepted risk. It stays counted among the open findings and never becomes Passing.
• On a manual control, signing off is how the control is satisfied. With evidence attached, it reads Attested.

A sign-off takes effect once evidence is linked to it. Attach evidence and link it to the sign-off to complete it.

Click to enlarge

1. Open the control record.
2. Under Attestations, click + Attest.
3. Optionally, enter Notes.
4. Optionally, set Expires (optional). The sign-off counts up to the end of that day (UTC).
5. Click Submit attestation. The record shows Sign-off recorded — see the list below.
6. Upload evidence and link it to the new sign-off. See Upload evidence.

When a sign-off expires it is marked Expired and stops counting. Any risk acceptance it carried reverts to the automated check’s own verdict, and a manual control goes back to Not assessed. Re-attest to accept the gap again.

Attestation history

Sign-offs are append-only: to change a decision, add a new sign-off. The Attestations (n) list shows each sign-off with its author, an Expired badge when it has lapsed, Linked evidence: n and when it was made. Click a sign-off to see Note, Signed off by, Signed off at, Expires and Evidence.

Upload evidence

Evidence files back your sign-offs. Each file is SHA-256 hashed on the way in, so you can later prove it has not changed.

1. Open the control record.
2. In Link to attestation, choose the sign-off this file supports, or keep (unlinked).
3. Click + Upload file and choose a file, or drag the file onto the drop zone (or drag and drop a file here).
4. Wait for Uploaded {file name} ({size}).

Allowed files

Rules:

• A file can be up to 100 MB.
• For a file larger than 50 MB, a Confirm large upload dialog asks you to confirm, because large uploads can take several minutes. Click Proceed to upload or Cancel to stop.
• The file name needs an extension that matches the file type, at most 255 bytes, no folder separators and no control characters, and it must not begin with ...
• Every upload passes a security scan. A file the scan rejects shows This file was rejected by the upload security scan. Please review the file before retrying.

Verify a file

Each evidence row shows the file name, type, size, upload time and the first characters of its SHA-256 hash.

• Copy: copies the full hash.
• Verify: downloads the file, hashes it in your browser and compares the result with the stored hash. The row shows ✓ verified when they match and ✗ tampered when they don’t. Hover over ✗ tampered to see both hashes.
• Download: downloads the file through a short-lived signed link.

The Evidence tab

The Evidence tab lists every evidence file uploaded for the selected framework, newest first.

Click to enlarge

Orphan files are uploaded but not linked to any sign-off. Auditors will ask about them, so link them or replace them. The Chain of custody panel on the Overview tab counts them.

Statement of Applicability

The Statement of Applicability (SoA) lists every control in the assessed scope, whether it applies, and why. Auditors ask for it in ISO 27001 audits, and it is useful for every framework.

Click to enlarge

1. Choose the Framework.
2. In Export document, choose Statement of Applicability.
3. In Export format, choose CSV, XLSX or PDF.
4. Click Export. The page shows Exported Statement of Applicability — {file name}.

The file is named soa-{framework}-{YYYYMMDD}.{ext}. It starts with a summary (Document, Framework, Tenant, Date, Total Controls, Applicable, Excluded) and lists each control with these columns:

Statuses

Sign-off

Evidence verification

Permissions

Related pages

• Compliance
• Custom frameworks
• Reports