Evidence Locker & Requests
The Evidence Locker is where your organization keeps the proof behind every CMMC claim: the screenshots, policies, configuration exports, tickets, and links that show an assessor how each objective is actually met. Every piece of evidence lives in one central library, is linked to the specific objectives it satisfies, and carries a review date so nothing quietly goes stale.
A CMMC assessment is ultimately an evidence exercise — a control isn't "met" because you say so, it's met because you can produce the artifact that proves it. The Evidence Locker is the system of record for those artifacts, and it feeds your compliance posture, your SPRS score, the System Security Plan (SSP), and the readiness dashboards. The Evidence Requests workflow layered on top lets an admin ask a teammate (or a managed client) to provide a specific artifact, then review it before it counts.
/dashboard/evidence). Evidence is also reachable in context from any objective — open a control's objective drawer to upload or link proof right where you're working. Viewing is open to every role that can read compliance data; uploading and managing requires a working role — see Permissions.Key concepts
Evidence scope
Every piece of evidence has a scope that controls which systems it applies to. Scope keeps a shared artifact (like an org-wide policy) from cluttering every system while still letting system-specific proof stay targeted.
| Scope | Applies to | Use it for |
|---|---|---|
| Global | Every system in the organization | Org-wide policies, company-level attestations |
| System | One specific system | Proof tied to a single boundary or environment |
| Selected | A chosen set of systems | An artifact that covers some, but not all, systems |
Evidence expiry
Evidence ages. A configuration export from last year no longer proves today's state, so every artifact carries a review date, and the locker surfaces what's approaching or past it.
| Status | Meaning |
|---|---|
| Valid | Review date is more than 30 days out |
| Expiring soon | Review date is within the next 30 days |
| Expired | Review date has passed — refresh or replace it |
Evidence request status
An evidence request is an ask for a specific artifact. It moves through a short lifecycle, and the request only becomes real, counted evidence once it's approved.
| Status | Meaning |
|---|---|
| Requested | Created and waiting for someone to upload the artifact |
| Submitted | Files uploaded, waiting for review |
| Verified | Reviewed and approved — now counts as evidence |
| Needs revision | Sent back with a note explaining what to fix |
| Cancelled | Withdrawn before approval |
Using the Evidence Locker
The Evidence page is your library: every artifact your organization has collected, grouped so that one file is one row no matter how many objectives it's linked to, with its scope, owner, linked objectives, and expiry visible at a glance. You can also work with evidence directly from any control's objective drawer.
Upload a single file
Choose where it goes
Open the objective you're proving (from the assessment view or the objective drawer) and start an evidence upload, or add it from the locker and link it afterward.
Pick the file
Select the artifact from your computer. Common document, image, spreadsheet, PDF, and archive formats are accepted, up to 100 MB per file.
Set scope and review date
Choose whether the evidence is Global, System, or Selected, and optionally set a review date. Leave the date blank to accept the default (about a year out).
Save
The file uploads to secure storage and appears in the Evidence Locker, linked to the objective, with its owner and expiry recorded.
Bulk upload
When you have several artifacts that all prove the same thing, upload them together instead of one at a time.
Select multiple files
From the objective or library upload dialog, choose up to 20 files in a single batch. They'll share the same objective links, scope, and review date.
Review the results
Each file is checked individually for size and type. Valid files upload; any that are too large or a blocked type are reported back per file so you can see exactly which ones didn't make it.
Add a link instead of a file
Not all evidence is a file. Some proof lives in another system — a ticketing board, a wiki page, a cloud console.
Add a URL
From the objective, choose to add evidence by link and paste the address. Only standard web (http/https) links are accepted.
Name it and set scope
Give the link a clear label, pick its scope, and optionally set a review date. It's now tracked alongside your files — links don't count against your storage allowance.
Link one artifact to many objectives
A single policy or export often satisfies several objectives at once. You don't upload it repeatedly — you upload once and link it everywhere it applies.
Upload or find the artifact
Add the file once, or open an artifact already in your locker.
Link additional objectives
Attach the same artifact to each objective it proves. It stays a single item in the Evidence Library, showing every objective it's linked to, rather than appearing as duplicate copies.
Track expiring and expired evidence
The locker highlights artifacts whose review date is within 30 days (expiring soon) or already past (expired). Work these first — an expired artifact is the most common reason a previously "met" control slips back into a gap. Replace the file or add a fresh link, and set a new review date.
Using Evidence Requests
Sometimes the person who has the evidence isn't the person managing the assessment. Evidence Requests let an admin formally ask for a specific artifact, hand it to the right person, and review what comes back before it counts. MSP partners use the same workflow to collect evidence from the client organizations they manage.
Create a request
Start a request
From the Evidence page, create a new request. You can start from a template (a pre-written ask for a common artifact, with suggested format and typical source already filled in) or from scratch.
Describe what you need
Give it a title and description, and optionally add instructions, a suggested format, and where the artifact typically comes from — enough that the recipient knows exactly what "done" looks like.
Point it at objectives and scope
Optionally link the request to the objectives it will satisfy and set its scope (global, one system, or selected systems). These are remembered and applied automatically when the request is approved.
Assign and set a due date
Assign the request to a teammate, set an optional due date, and set the review date the resulting evidence should carry.
Send
The request appears as Requested and the assignee can now provide the files.
Submit evidence for a request
The assignee opens the request and uploads what was asked for.
Upload the files
Attach one file, or several. The same rules apply — up to 100 MB per file, up to 20 files at once, and the whole submission is checked against your storage allowance together.
Add a note and submit
Optionally leave a note for the reviewer. The request flips to Submitted and waits for review.
Review a submission
An admin (or the managing MSP) reviews what came in and decides.
Open the submitted request
Review the uploaded files and any note from the submitter. Each request also has a comment thread for back-and-forth.
Approve, or send back
Approve to verify the evidence — it becomes real, counted evidence and is attached to every objective the request was pointed at. Or request revision with a required note explaining what needs fixing; the request returns to the submitter, who can re-upload a clean set.
Permissions
Access to evidence is governed by a small set of capabilities in the role matrix.
| Capability | Permission |
|---|---|
| View the locker, artifacts, and request threads | VIEW_EVIDENCE |
| Upload files, add links, link evidence to objectives, submit requests | UPLOAD_EVIDENCE |
| Rename evidence and edit its details | EDIT_EVIDENCE |
| Delete evidence | DELETE_EVIDENCE |
| Create, assign, review, approve, and cancel requests | MANAGE_EVIDENCE_REQUESTS |
VIEW_EVIDENCE is held by every non-platform role, including Assessor (read-only). Uploading and editing are held by Org Admin, Org User, MSP Super, and MSP Admin. Deleting evidence and managing requests are reserved for admins — Org User can upload and edit but not delete, and Assessor is view-only.
How it works
Extra detail on how the locker behaves — product behavior, not internals.
What a piece of evidence holds
Each artifact is a single record that belongs to your organization.
Allowed files and size
Each uploaded file can be up to 100 MB, and a single bulk upload can carry up to 20 files. For safety, executable and script-type files (and raw web pages) are refused outright — an assessor wouldn't accept those as evidence anyway. Everything is validated the same way whether you upload one file or a batch, so the rules never drift between the two paths.
Storage allowance and hitting the cap
Every file you keep counts toward your organization's storage allowance, which is set by your subscription plan — starting at 1 GB on the Foundation plan and scaling up on higher plans. External links and evidence requests that haven't been fulfilled don't consume storage; only the actual files do.
Before any upload, the app adds up what you're already storing and checks whether the new file (or the whole batch) would fit. If it wouldn't, the upload is refused with a clear message showing your current usage against the cap, and nothing is stored. Your exact allowance and live usage are always visible on the billing page.
Why a request isn't evidence until it's approved
An evidence request starts life as an empty shell. When someone uploads to it, the files attach to the request but stay off your objectives; the request only becomes evidence on approval. That single rule keeps every place that counts evidence — your completion percentage, SPRS score, the SSP, and the weekly status email — honest: an artifact you see attached to an objective is always real, verified proof, never a pending ask. This is why the objective drawer and your dashboards only ever show verified evidence.
Where evidence shows up
Once verified, an artifact surfaces everywhere it's relevant:
- On each objective it's linked to, in the objective drawer, as proof toward that control.
- In your completion percentage and SPRS score, because the objective now has evidence behind it.
- In the System Security Plan (SSP) export, as part of the documented implementation.
- On your dashboards and in the weekly status email, which surface expiring and expired evidence so nothing lapses unnoticed.
Related features
Document Library
Generate, edit, review, approve, and publish the policies CMMC requires — with merge fields, CMMC clause highlighting, full revision history, and PDF/Word export. Publishing turns a policy into control-linked evidence.
SSP Builder
Assemble a complete, assessor-ready System Security Plan — organization and system details, boundary, asset inventory, external providers, interconnections, diagrams, and per-control implementation narratives — then preview, print, or export it to PDF.