Collect evidence once. Prove it everywhere.
Every artefact from every module in one encrypted library, mapped to the controls it proves, reused across every framework those controls satisfy, and kept fresh with expiry tracking.
| ID | Evidence | Mapped to | Status |
|---|---|---|---|
| E-904 | Q3 access review sign-off | ISO A.5.18 · PCI 7.2.4 | Current |
| E-901 | Vulnerability scan report | PCI 11.3 · ISO A.8.8 | Current |
| E-897 | DR test results | ISO A.5.30 · SOC 2 A1.3 | Current |
| E-880 | Security awareness roster | ISO A.6.3 · HIPAA | Due |
| E-812 | 2024 pen test report | PCI 11.4 | Retired |
Illustration with sample data
What Evidence Library does
Evidence is the currency of compliance, and most teams collect the same artefact several times a year for different frameworks. The Evidence Library holds evidence from risks, findings, tasks, controls, self-assessments, vendors and privacy assessments in one place, and every file is encrypted at rest. AI drafts evidence-to-control mappings for you to confirm. Because controls map to the Secure Controls Framework, one accepted file proves every requirement the control satisfies.
Freshness is worked out automatically: Current, Expiring Soon, Expired, Under Review, Superseded or Retired. Validity comes from when the evidence was collected, the requirement's maximum age and any explicit valid-until date. Scanned documents are read by local OCR on the server, so their content never leaves your environment. People outside RiskVantis can upload through secure, expiring links.
Key capabilities
One encrypted library
Evidence from every module, encrypted at rest.
Collect once, prove many
Evidence mapped to canonical controls counts for every linked framework.
AI-drafted mappings
Suggested evidence-to-control mappings that learn from assessor feedback.
Freshness states
Current, Expiring Soon, Expired, Under Review, Superseded, Retired.
Local OCR
Scanned PDFs and images read on your server; nothing is sent out.
Secure upload links
Expiring, revocable links for people without an account.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Evidence Library changes for your programme.
Less evidence collection effort
Reuse across frameworks, scheduled requests and self-service uploads remove most repeat collection.
Collect once
Mapping lets a single evidence item satisfy every related requirement.
No stale evidence in audits
Expiry tracking flags evidence before it lapses.
Evidence protected
Files are encrypted at rest and downloads are audited.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Collect
Upload, request, schedule or receive evidence from modules.
Map
Confirm AI-drafted mappings to controls and requirements.
Reuse
Evidence counts toward every mapped framework.
Keep fresh
Track expiry; revalidate or retire with history kept.
Supports your obligations.
Evidence Library contributes evidence and coverage to these frameworks and regulations.
Common questions.
Can people without an account upload evidence?
Yes. Generate a secure, expiring link that you can revoke at any time.
Does accepting evidence make a control compliant?
Accepting evidence never declares it reliable, authentic or compliant by itself. Compliance status is calculated from tests, evidence requirements and applicability.
Are scanned documents sent to an outside OCR service?
No. OCR runs locally on the server and decrypted bytes are never written to disk.
Works better together.
Evidence Requests & Reminders
Ask the right person for the right evidence with a due date and an independent reviewer. Then let one reminder engine nudge, escalate and follow up across every…
Learn more →Evidence & Audit ReadinessEvidence Scheduler & Compliance Calendar
Recurring evidence schedules and every compliance due date on one calendar, so control operation is proven continuously rather than reconstructed before the…
Learn more →Compliance ManagementAI Control Mapping
Map risks, findings, evidence, policy controls, internal processes and benchmark controls to canonical controls. AI drafts each mapping, assessors confirm it, and every…
Learn more →See Evidence Library in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.