Evidence, checks and findings

Attach evidence

1. On a control’s page, press Attach evidence.
2. Say What is it? and Where does it live?, add The file if there is one (PDF, PNG, JPEG, DOCX or XLSX, up to 50 MB), choose Who may see it, and How long is it good for? (a year unless you say otherwise).
3. Press Attach it. Every file is scanned for malware first; one that fails is refused and not kept. Evidence past its date no longer counts.

Checks your connections run

• Each connection runs its checks each time it is read. Choose how often under Monitoring, on Collection: manual, every hour, every 6 hours, daily or weekly.
• On Checks you can give a check its own cadence. A result counts for twice its cadence, allowing for one missed run; after that the control shows as gone stale.
• Monitoring shows what is failing, what was verified recently, what has gone stale and what was never verified.

Checks a person does

On a control’s page, press Record a check: what you checked, what you found (in place and working, partly, not in place, or not applicable), what you saw, and how long it stands for.

Work the findings

1. Open Findings. Each failing check raises one.
2. Press Add a task: what needs doing, who, and by when. With Jira connected, Send to files it as an issue.
3. Press Decide to say where it stands: Being fixed; Fixed (with a reason); Accept the risk (with a reason and a date, at most a year ahead); Not a real problem (with a reason); or Reopen.

A passing reading closes a finding by itself. A finding marked fixed by hand is raised again if the next reading still fails. A task done in Jira closes the task, not the finding.