GRC Evidence Pack
The GRC evidence pack is a ZIP file with 12 months of vulnerability handling evidence. Upload it to your GRC tool, for example Vanta, Drata or Tidal Control. It gives evidence for ISO/IEC 27001:2022 control 8.8 and for NIS2 Article 21(2)(e). The pack needs the Reporting plan or higher.
Download the pack
- Open Analytics.
- Go to Evidence for your GRC tool, below the figures.
- Click Download evidence pack.
Every role can download the pack. Each download is recorded in the audit log.
Files in the pack
| File | Content |
|---|---|
00-summary.pdf | The control mapping, the disclosure channel, the approved policies, the figures for the period and the audit log check |
control-mapping.csv | One row for each control, with the requirement, the evidence, the files and the status |
vulnerability-reports.csv | One row for each report received in the period, with the times of each step |
advisories.csv | The advisories published or withdrawn in the period |
audit-events.csv | The audit events of each handling step in the period |
disclosure-policy.md | The disclosure policy as it is published on your portal |
README.txt | The file list and the upload steps |
Controls
| Framework | Reference | What the pack shows |
|---|---|---|
| ISO/IEC 27001:2022 Annex A | 8.8 Management of technical vulnerabilities | Each report with its receipt, acknowledgement, remediation decision, resolution and fix verification. Published advisories. The audit events. |
| NIS2, Directive (EU) 2022/2555 | Article 21(2)(e) | The published disclosure channel and policy, and the handling record |
| Implementing Regulation (EU) 2024/2690 | Annex, point 6.10.2(e) | The disclosure policy. You decide if it agrees with your national CVD policy. |
| Implementing Regulation (EU) 2024/2690 | Annex, point 6.10.3 | The remediation decision of each report and whether its rationale is on record |
Implementing Regulation (EU) 2024/2690 applies only to the entity types in its Article 1, for example cloud computing and managed service providers. Use those two rows only if your company is one of them.
A control with no records in the period says so in its status. It does not show as met.
Upload to a GRC tool
- Open the vulnerability management control in your GRC tool.
- Upload
00-summary.pdfas the evidence document. - Attach the CSV files to the same control.
control-mapping.csv names the file for each control.
What the pack leaves out
The pack goes to a third party. Thus it holds no report content, no reporter name or contact, no internal note and no remediation rationale text. It records that each step happened and when.
The pack does not replace your own vulnerability management procedure. Most auditors ask for that document first.
How the figures are counted
- The period is the 12 months before the download.
- The pack counts only reports received in the period. The Analytics page counts every report since the account opened, so its figures can differ.
- A report is acknowledged on time when it is acknowledged within your acknowledgement target. A report younger than the target is not counted yet.
- The hash chain line shows the result of an audit log check at the time of the download.