Skip to content
LEGIT AIDOCS
Open the console

Compliance evidence

Collect evidence for ISO 27001, SOC 2, PCI DSS v4 and the Central Bank of Uzbekistan, attest what a machine cannot see, and export it for your auditor.

Compliance collects what Legit AI already records into evidence against a framework’s controls. It is available from the Professional plan.

Frameworks

Section titled “Frameworks”

Evidence packages exist for ISO 27001, SOC 2 Type II, PCI DSS v4 and the requirements of the Central Bank of Uzbekistan (CBU). NIST CSF, GDPR and HIPAA have the live posture matrix and its export, without an evidence package.

Make an evidence package

Section titled “Make an evidence package”

  1. In Compliance, open Generate Evidence Package.

  2. Choose the Framework, Period Start and Period End.

  3. Generate it. An ANALYST or above can do this. The report shows coverage and each control as Covered, Partial or Gap, with the evidence behind it.

  4. Download XLSX Evidence Package saves it for your auditor.

Attest what a machine cannot see

Section titled “Attest what a machine cannot see”

Some controls rest on people and paper. A person can attest a control with a status, an evidence note and how many days the attestation lasts, and the attestation is shown beside the control.

Where the evidence comes from

Section titled “Where the evidence comes from”

Sign-ins, rule changes, triage decisions and response actions, from the audit log and the alert lifecycle. Nothing leaves your network to compile it.

History is kept for your plan’s period, up to seven years on Bank & Gov. See Plans and limits.