Evidence an assessor will request

From the hosting layer

These come from us. Request them through the Client Portal under Compliance. Most are available immediately; assessment reports require an executed NDA and take a few business days.

• The current control responsibility matrix for your boundary.
• The most recent assessment report and continuous monitoring summary.
• Facility physical security evidence covering the regions you deploy in.
• Media sanitization records for any host you have decommissioned.
• Platform audit log extracts covering your boundary for the assessment period.

From you

These are yours to produce, and they are the ones that cause schedule problems when nobody has been keeping them current.

• Application audit logs covering the assessment period, with evidence they were reviewed rather than merely retained.
• Operating system configuration baselines and evidence of drift monitoring.
• Your account management records, including evidence of periodic access review.
• Restore test results. An untested backup is a finding.
• Patch records for the operating system and application layer.

Access review evidence is the single most common gap. Reviews happen, but nobody records that they happened, and an unrecorded review is indistinguishable from no review.

Timing

Request hosting layer evidence at least three weeks before fieldwork starts. Assessment reports under NDA involve a legal step on both sides, and that step is where schedules usually slip.

If your assessment date is already fixed and close, contact your deployment engineer directly rather than filing a portal request.