> ## Documentation Index
> Fetch the complete documentation index at: https://docs.regentra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Evidence Collection

> Collect compliance evidence automatically through integrations or manually, and attach it to controls for audit readiness.

Evidence is the proof that your controls are implemented and operating effectively. Auditors do not take your word for it — they want screenshots, logs, configuration exports, and reports. Regentra streamlines evidence collection with both automated and manual workflows.

## Automated Evidence via Integrations

When you connect a cloud or identity integration, Regentra pulls evidence automatically and attaches it to the relevant controls.

<Tabs>
  <Tab title="Microsoft Entra ID">
    * MFA enrollment status for all users
    * Conditional access policy configurations
    * Privileged role assignments (standing and PIM-eligible)
    * Sign-in and directory audit logs
    * Device compliance and security defaults
  </Tab>

  <Tab title="AWS">
    * IAM password policy and root MFA
    * Per-user MFA, access-key age, and unused-credential checks
    * CloudTrail logging status
    * S3 bucket public-access and encryption settings
    * EC2 security groups, EBS encryption, RDS security
    * KMS key rotation, VPC flow logs
  </Tab>

  <Tab title="GCP">
    * Service-account key age and admin-role bindings
    * Compute firewall rules and default-network presence
    * Cloud Storage public access and CMEK encryption
    * Cloud SQL SSL/private-IP/backup configuration
    * Cloud KMS key rotation, Audit Log configs, Log Sinks, Monitoring Alerts
    * VPC flow logs, OS Login enforcement
  </Tab>

  <Tab title="Proofpoint Security Awareness">
    * Security awareness training completion rates
    * Phishing simulation campaign results
  </Tab>
</Tabs>

<Note>
  **Level.io** is integrated for PSA-side asset and ticket sync, not compliance evidence collection. Connecting Level.io populates your Configurations module — it does not currently feed automated evidence to compliance controls.
</Note>

<Info>
  Automated evidence is refreshed on a schedule. Regentra pulls fresh data from connected integrations so your evidence stays current without manual effort.
</Info>

## Manual Evidence Upload

Not everything can be automated. For controls that require human-generated evidence, you can upload files or add links directly.

<Steps>
  <Step title="Open the control">
    Navigate to the control that needs evidence and open its detail page.
  </Step>

  <Step title="Go to the Evidence section">
    Scroll to the **Evidence** tab on the control detail page.
  </Step>

  <Step title="Upload or link">
    Click **Add Evidence** and choose:

    * **Upload file** — PDFs, screenshots, spreadsheets, configuration exports, or any relevant document
    * **Add link** — URL to an external dashboard, monitoring tool, or shared document
  </Step>

  <Step title="Add context">
    Provide a description of what the evidence demonstrates and how it relates to the control.
  </Step>
</Steps>

Common types of manual evidence:

* Signed policy acknowledgment records
* Meeting minutes from security reviews
* Vendor assessment questionnaires
* Physical security photos
* Training completion certificates

## Evidence Attached to Controls

Every piece of evidence in Regentra is attached to one or more controls. This creates a direct audit trail:

**Framework requirement → Control → Evidence**

When an auditor asks "How do you satisfy HIPAA § 164.312(a)(1)?", you can show them the control, its implementation notes, and every piece of evidence supporting it — all in one place.

Because controls map across frameworks through the CCF, evidence attached to a shared control counts toward every mapped framework. Upload once, satisfy many.

## Monitoring Signals and Compliance Status

Some evidence is not a static document but a **live signal** — an ongoing check that something is still true. Regentra's monitoring signals track:

* **MFA enforcement** — is MFA still enabled for all users?
* **Encryption status** — are storage resources still encrypted?
* **Logging configuration** — are audit logs still being captured?
* **Patch compliance** — are devices still up to date?

When a monitoring signal detects a change (e.g., MFA was disabled for a user), the associated control's status is flagged for review.

<Warning>
  A control marked as Implemented can be automatically flagged as **Needs Review** if a monitoring signal detects drift. This ensures your compliance posture reflects reality, not just a point-in-time snapshot.
</Warning>

## Evidence Expiration and Refresh Cycles

Evidence does not last forever. Auditors expect to see current proof, not year-old screenshots.

Regentra manages evidence freshness through:

* **Expiration dates** — set an expiration on any piece of evidence. When it expires, the associated control is flagged for review.
* **Automated refresh** — evidence from connected integrations is refreshed on a configurable schedule (daily, weekly, or monthly).
* **Review reminders** — the dashboard highlights controls with stale or expired evidence so your team knows where to focus.

<Tip>
  Set evidence refresh cycles to match your audit cadence. If you undergo annual SOC 2 audits, ensure all evidence has been refreshed within the audit period. For HIPAA, keep evidence current year-round since OCR investigations can happen at any time.
</Tip>