The first audit I supported, we handed the auditor a shared folder with around two hundred screenshots in it. He opened three, closed the laptop, and asked which account they were from and when they were taken. We did not know. That was a long week.

Since then I have been on both sides of that table more times than I would like, and the same misunderstanding comes up every single time. Teams think evidence means "something that shows the control is on". Auditors think evidence means "something I can defend in front of my own reviewer". Those are not the same thing, and the gap between them is where most of the pain lives.

A screenshot proves that at some point, someone, somewhere, saw a green tick.

The four properties, and I mean all four

Whatever the framework, ISO 27001, SOC 2, a customer's own questionnaire, evidence that gets accepted without a follow-up question has these properties. Miss one and you will be asked for it again.

Notice what is not on the list. It does not have to be pretty. It does not have to come from an expensive tool. A CLI output pasted into a text file with the command, the date and the account ID at the top beats a polished dashboard screenshot every time.

Control by control: what actually works on AWS

These are the ones that come up in nearly every review. For each, what I hand over now, and what I used to hand over before I learned better.

Access control and MFA

Used to be: a screenshot of the IAM users page with the MFA column visible. Rejected, twice, because it showed the first fifty users and the account had ninety.

Now: a query output. If you already run Steampipe from the audit setup in an earlier post, this is one file. 

-- run 2026-09-08 09:14 UTC, account 123456789012, role audit-readonly
select name, mfa_enabled, password_last_used
from aws_iam_user
where password_enabled
order by name;

Save the query and the result together. If the auditor wants to see it live, run it again in front of them. That moment, where you rerun the thing and it says the same answer, is worth more than any document.

Logging and monitoring

Used to be: a screenshot of the CloudTrail console showing a trail exists.

Now: the actual trail configuration as JSON from aws cloudtrail get-trail plus get-event-selectors, showing multi-region, log file validation, the destination bucket, and that the bucket has a retention policy. Then one Prowler finding, filtered to the CloudTrail checks, with the run date. Two files, no interpretation needed.

Encryption at rest

This one is fun, because the console lies by omission. The RDS page will happily show "Encrypted: yes" for the instance you clicked, and say nothing about the other eleven.

Now: a Prowler run filtered to the encryption checks across RDS, EBS, S3 and EFS, exported as JSON, with the summary line that says how many resources passed and how many failed. If the answer is "three failed", say so and attach the ticket where they are being fixed. Auditors are far more relaxed about a known, tracked failure than about a suspiciously perfect report.

Change management

Used to be: a copy of the change management policy. A PDF. Eleven pages.

Now: the policy, plus three merged pull requests picked at random from the review period, each showing a reviewer approval, a passing pipeline, and the Infracost or plan output that the reviewer saw. The policy says what should happen. The PRs show that it did. Nobody has ever asked me a follow-up question on this one since I switched.

Vulnerability management

Now: the scanner export for the period, and, more importantly, the list of findings that were opened, closed, and how long each stayed open. The control is rarely "you have no vulnerabilities". It is "you find them, and you fix them within the time you said you would". Bring the timeline, not the count.

What gets rejected, and why it stings

The part that still hurts

Even when you do all of the above properly, there is a structural problem that no amount of discipline fixes. Evidence is a snapshot. The control is continuous.

You run the query on the 8th. On the 9th someone creates a user without MFA for a contractor. On the 22nd the auditor picks that user. The evidence in the folder was true when you gathered it, and it is still sitting there, quietly out of date, next to a tick in a spreadsheet that says "done".

Most teams handle this with a person and a calendar reminder. Gather everything again every quarter, or in a panic the week before the review. That works, in the sense that surviving works. It is also the reason security people look tired in March.

The honest fix is that evidence has to regenerate itself. The query that produced the export in the folder should be the same query that runs tonight, and the control should be marked as met because tonight's run passed, not because someone pasted a result three months ago. Everything above, the timestamps, the resource IDs, the mapping to controls, was really about making evidence machine-shaped enough that this becomes possible.

Start with the folder. Get the four properties right. Then notice how much of the work is the same every quarter, and ask why a human is still doing it.