Evidence Management

Evidence management is the operational core of your compliance program. Every control needs artifacts that demonstrate implementation, and Claw GRC provides the tools to collect, validate, track, and map those artifacts efficiently.

What Counts as Evidence?

Evidence in Claw GRC includes any artifact that proves your organization has implemented a control:

Source Type	Examples	Common Controls
screenshot	IAM policy screenshots, firewall rule configs	Access control, network security
document	Security policies, procedures, runbooks	Governance, documentation
api_export	CloudTrail logs, SIEM exports	Audit logging, monitoring
log	System logs, change management records	Change management, operations
configuration	Terraform configs, Kubernetes manifests	Configuration management
certificate	SSL certificates, SOC 2 reports from vendors	Third-party risk
report	Penetration test reports, audit results	Assessment, risk management

Uploading Evidence

From the UI

1. Navigate to Evidence in the sidebar
2. Click Upload Evidence
3. Fill in the evidence details:
   • Source Type -- Select from the available types
   • Source Identifier -- A descriptive label (e.g., "AWS IAM Policy - Production Account")
   • File -- Upload the artifact (PDF, PNG, JSON, CSV, etc.)
   • Control Mapping -- Link this evidence to one or more unified controls
4. Click Submit

The platform computes a SHA-256 hash of the uploaded file for integrity verification and records the upload timestamp for freshness tracking.

From the API

curl -X POST https://api.clawgrc.com/api/v1/evidence \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "source_type": "screenshot",
    "source_identifier": "AWS IAM Policy - Production",
    "requirement_id": "req-uuid-here",
    "metadata": {
      "aws_account": "123456789012",
      "region": "us-east-1"
    }
  }'

From an Agent

Agents can submit evidence through the MCP protocol:

curl -X POST https://api.clawgrc.com/api/v1/mcp/message \
  -H "X-API-Key: cgrc_YOUR_AGENT_KEY" \
  -d '{
    "session_id": "mcp_...",
    "method": "grc.submit_evidence",
    "params": {
      "source_type": "api_export",
      "source_identifier": "Automated CloudTrail Export",
      "requirement_id": "req-uuid-here"
    }
  }'

Evidence Lifecycle

Evidence artifacts move through a defined lifecycle:

Statuses

• Pending -- Uploaded but not yet reviewed. Does not count toward compliance score.
• Validated -- Reviewed and approved. Counts toward compliance score if within freshness window.
• Rejected -- Reviewed and found insufficient. Does not count toward compliance score.
• Expired -- Previously validated but past its freshness window. Needs to be refreshed.

Freshness Tracking

Each evidence requirement defines a freshness period (in days) that specifies how often evidence must be refreshed. Default is 90 days.

The platform tracks freshness automatically:

• Current -- Evidence collected within the freshness window
• Expiring soon -- Within 14 days of expiration
• Expired -- Past the freshness window

warning

Expired evidence does not count toward your compliance score. Set up a regular cadence for refreshing evidence, especially for controls that auditors examine closely.

Evidence Requirements

Evidence requirements are linked to unified controls and define what the auditor expects to see:

Field	Description
evidence_type	Type of evidence expected (e.g., "screenshot", "log export")
description	Detailed description of what the artifact should contain
automation_level	manual, semi_automated, or fully_automated
freshness_days	How often this evidence must be refreshed

Soft Delete

Evidence artifacts support soft deletion. When you delete evidence, it is not permanently removed -- instead, a deleted_at timestamp is set. This preserves the audit trail while removing the artifact from active use. Soft-deleted evidence does not count toward compliance scores.

API Endpoints

Method	Endpoint	Description
GET	/api/v1/evidence	List evidence artifacts
POST	/api/v1/evidence	Upload new evidence
GET	/api/v1/evidence/:id	Get evidence details
PUT	/api/v1/evidence/:id	Update evidence metadata
DELETE	/api/v1/evidence/:id	Soft-delete evidence

See Evidence API Reference for full documentation.

Tips and Best Practices

• Automate evidence collection -- Use agents or integrations to automatically export evidence from AWS, GCP, GitHub, and other platforms on a scheduled basis.
• Use descriptive source identifiers -- Future you (and your auditor) will thank you for labels like "AWS IAM MFA Policy - Production - Q1 2025" instead of "iam-screenshot.png".
• Map evidence to multiple controls -- A single evidence artifact often satisfies multiple requirements. Map it broadly to maximize compliance coverage.
• Set freshness reminders early -- Configure notifications to fire at 30, 14, and 7 days before evidence expires, not just at expiration.
• Review rejected evidence promptly -- When evidence is rejected, understand why and re-upload quickly to minimize gaps in your compliance posture.