Paste the sheet you run your controls from. Get back what proves each one.
Every control mapped to the evidence auditors commonly ask for, the system that evidence already lives in, and which of your periodic reviews can become a live record instead of a quarterly scramble. First run needs no account.
A.5.1 Policies for information security Annual policy review, board sign-off Priya A.5.15 Access control Access review spreadsheet every 6 months Sam A.5.18 Access rights Leaver checklist emailed to IT Sam A.5.23 Cloud services Vendor list in SharePoint, reviewed yearly Jordan A.6.3 Awareness training Training tracker xlsx, certificates in a folder HR A.8.2 Privileged access Admin list checked quarterly Sam A.8.8 Technical vulnerabilities Scan report attached to the monthly ticket Ops A.8.15 Logging Quarterly log review meeting Ops A.8.16 Monitoring Alerts reviewed weekly, screenshots saved Ops Backups Backup restore test twice a year Ops 9.2 Internal audit programme Annual audit by consultant Priya 9.3 Management review Minutes in the ISMS folder Priya
Paste, or start from the standard
Rows from Excel, Google Sheets, a GRC export, a Word table. Clause numbers are matched exactly; rows without one are matched on their wording, and a doubtful match is marked so you check it rather than trust it.
See what proves each control
For every control: the artefacts auditors commonly ask for, grouped by whether a system already holds them, a person produces them at each review, or they are the governing document. Plus the common gap auditors find on that exact control.
Take live the reviews that can be records
A first move per control: which system already holds the evidence and what to pull from it on a schedule. The controls that are genuinely people and documents are told so, because automating those is where continuous compliance projects go to die.
Why a sheet and not another platform
The funded compliance platforms want your whole programme migrated and integrated before they show you anything. Your controls already live in a spreadsheet, and the spreadsheet is fine. What it lacks is the column that says what evidence each row needs and where that evidence already exists. That is the column this builds, in under a minute, from the rows you already have.
On Solo and Team a saved sheet goes one step further: one evidence request per control owner, answered through a private link by saying where each item is and the period it covers, then accepted or returned by you line by line, with the whole trail in the export. Your assessor still decides what is sufficient.
Evidence for every control you run: the questions buyers ask
What is an evidence sheet?
In compliance and audit work, an evidence sheet lists the controls you run and, for each one, the evidence that proves it operates, the system that evidence lives in and who holds it. Evidence Sheet builds one from the spreadsheet you already keep. The same name is used for other forms elsewhere; this is the audit kind.
What does Evidence Sheet give me?
You paste the sheet you run your controls from and it maps every control to the evidence auditors commonly ask for, the system that evidence already lives in, and which of your periodic reviews can become a live record. The requirement on every row comes from the standard and is cited to its clause.
Which frameworks, and how many requirements, does it hold?
29 frameworks and 4,198 requirements, from ISO/IEC 27001, clauses 4 to 10 and Annex A, and SOC 2 to NIST SP 800-53, PCI DSS v4.0.1, CIS Controls v8.1, HIPAA, GDPR and DORA. Nothing is generated on the fly.
Where does the requirement text come from?
Each requirement is our statement of its clause, read from the published text and cited so you can check it against the official text and cited to it, not the instrument verbatim. Each requirement page names its source and edition.
Is the evidence list part of the standard?
No. The evidence lists are our guidance on what auditors commonly ask for, and no standard contains them. Your assessor decides what is sufficient, and Evidence Sheet never rules on you.
How are my rows matched to controls?
Clause numbers are matched exactly. Rows without a clause number are matched on their wording, and a doubtful match is marked so you check it rather than trust it.
What does it tell me for each control?
The artefacts auditors commonly ask for, grouped by whether a system already holds them, a person produces them at each review, or they are the governing document. It also gives the common gap auditors find on that exact control.
Can I start from a standard rather than my own sheet?
Yes. You can paste rows from Excel, Google Sheets, a GRC export or a Word table, or start from the full framework, and the default framework is ISO/IEC 27001:2022.
Does it make my periodic reviews live records?
It gives a first move per control: which system already holds the evidence and what to pull from it on a schedule. The controls that are genuinely people and documents are told so, because automating those is where continuous compliance projects go to die.
Can I chase control owners for the evidence?
Yes, on Solo and Team. There is one evidence request per control owner, answered through a private link by saying where each item is and the period it covers, then accepted or returned by you line by line, with the whole trail in the export.
Do I need an account to try it?
No. The first run needs no account, and nothing you paste leaves your browser until you choose to save it.
Does it replace my spreadsheet?
No. Your controls already live in a spreadsheet and the spreadsheet is fine; what it lacks is the column that says what evidence each row needs and where that evidence already exists. That is the column this builds, from the rows you already have.
Does it decide whether a framework applies to me, or whether I pass?
No. It maps your own rows to the requirements and the evidence, and it never rules on you. Your assessor still decides what is sufficient.
How Evidence Sheet compares with a spreadsheet, an assessor or a general assistant
Your controls already live in a spreadsheet, and Evidence Sheet says plainly that the spreadsheet is fine and does not replace it; what the spreadsheet lacks is the column that says what evidence each row needs and where that evidence already exists. An internal auditor or an external assessor decides what is sufficient, and a compliance consultant can weigh a difficult control in its context, which this tool never does; it maps your own rows to the requirements and the evidence and never rules on you. A general AI assistant will suggest evidence for a control from memory, but it will not match your clause numbers exactly, mark a doubtful wording match for you to check, or read the requirement from the copy of the standard held. Evidence Sheet adds, for every control, the artefacts auditors commonly ask for grouped by whether a system already holds them, the common gap on that control and which periodic review can become a live record, and on Solo and Team it sends one evidence request per control owner and takes the answers back line by line; the evidence lists are its own guidance, no standard contains them, and your assessor decides what is sufficient.
Primary source: ISO/IEC 27001:2022