Skip to content

Evidence packs

/evidence

Evidence is the org-wide audit log plus a per-release export. Between them they answer the question every assessor, customer questionnaire, and incident post-mortem eventually asks: what did you know, and when did you know it?

The audit log

The Evidence area records what happened across the organisation:

  • SBOM and firmware uploads
  • Scans and scheduled rescans
  • Triage decisions, with justifications and who made them
  • Awareness timestamps
  • Advisory drafts, sends, and publications

Each entry carries the actor and the time. This is deliberately not editable: an audit trail that can be tidied up afterwards is not an audit trail.

Per-release evidence packs

From a release you can generate an evidence pack: a single document set containing

Contents Why it is in there
The SBOM(s) for the release Vendor, derived, or both: what the inventory actually was
Findings The CVEs matched against that inventory
Triage decisions and VEX What you concluded, and the justification
Decision history Who decided, and when
Awareness history When the manufacturer became aware, per incident

This is the seed of an Annex VII technical file. It is not a CE-mark generator and not a Declaration of Conformity.

Generate the pack before you file

Evidence pack hashes recorded on an exploit incident tie the Article 14 filing to the exact SBOM, findings, and triage decisions that existed at the time of filing.

For those hashes to be stable and meaningful, generate the pack from the affected release before you submit the report, not afterwards, when the inventory may already have moved on.

The 14-day final report payload references those hashes directly.

What evidence is for

Three audiences, in rough order of how often they turn up:

Customer questionnaires. Large buyers increasingly ask suppliers to demonstrate vulnerability handling. A per-release pack answers most of a questionnaire without a meeting.

Market surveillance authorities. Under the CRA they can ask a manufacturer to produce the technical documentation. The pack is the part alloy-it can produce from data; the rest is tracked on the conformity checklist.

Your own incident review. When something goes wrong, the decision history is what tells you whether the process failed or the information was genuinely not available.

How it relates to conformity

Two halves of the same obligation:

Answers
Conformity checklist What documentation must exist for this product?
Evidence pack What does alloy-it hold for this release, exported?

The checklist tracks the documents you must be able to produce, including ones that live in your own document management system. The pack is the export of what the platform can prove.

Next