Manual evidence and attestations

Some controls need a human to confirm them, for example a quarterly access review or a signed disposal policy. For these, use a manual attestation check.

Add evidence

1. Open the control under Compliance.
2. Select Add evidence and upload the file, for example a PDF of the review.
3. Set valid until, and add a note explaining what the evidence shows.

How it's evaluated

A manual attestation check has a frequency, for example every 90 days. It passes while evidence was uploaded and confirmed within that interval, and fails once it's overdue, so you can see at a glance which reviews are due.

Good to know

• Evidence files are stored privately for your organisation.
• Uploading evidence is recorded in the audit log, with who did it and when.
• Wipe and destruction certificates for disposed devices are attached to the disposal itself and checked by the Disposal evidence check. See Retiring, disposing and lost devices.