Controls and evidence

Turn each policy into controls with an owner and an automated check. Map them to SOC 2 or ISO 27001 and collect dated evidence from CI and the cloud.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

Required

Turn every policy line into a checked control
Required
Keep a register of controls in the repository. Each control has an ID, one testable statement, an owner, a frequency and the command that checks it.
Collect evidence automatically
Required
Let scheduled jobs collect evidence for each automated control from CI, the code host and the cloud. Save each result with a date and a hash.
Keep evidence where nobody can change it
Required
Store evidence in write-once storage, in folders by date, and keep it for the audit period plus at least one year.
Prove every production change was reviewed
Required
For every production deploy, keep a link to the commit, the pull request, an approval by someone other than the author, and the passing checks.
Keep every policy short and owned
Required
Give every written policy an owner, a version, an approval date and a review date within 12 months. Track that every person has read the current version.
Keep a risk register with treatment dates
Required
Keep a register of security and privacy risks as data. Give each risk a likelihood, an impact, an owner, a treatment and a review date within 12 months.