Skip to content

Controls and evidence

Evidence, once. Counted for every requirement it supports.

A single control often covers requirements in ISO 27001 and NEN 7510 at the same time. Trustbird records that link, so the evidence you attach to a control shows up everywhere it applies. You gather it once and keep it current in one place.

Become a design partner Talk to us
  • Controls mapped across standards
  • Evidence with source and original date
  • Reminders before evidence expires

Controls and evidence an auditor can follow

An auditor wants to know what you do, where that is shown and whether it is still true. Trustbird keeps those three together for every control.

Mapped across standards

Each control is linked to every requirement it satisfies, in every standard you carry. You see at a glance what a control covers.

Evidence once, counted everywhere

Attach evidence to the control, not to the requirement. It then counts for every requirement that control supports.

Evidence with provenance

Every piece of evidence keeps its source and its original date, separate from the moment it was added. You can always show where it came from.

Expiry and reminders

Set how long evidence remains valid. The owner gets a reminder in time, and outdated evidence is clearly marked.

Owners per control

Every control has a named owner. The overview shows who is responsible for what and where something is still open.

Statement of Applicability

Record for each control whether it applies, why, and whether it is in place. Trustbird builds the Statement of Applicability from those choices.

How it works

  1. 01

    Select your controls

    Decide, based on your risks, which controls apply to your organization and record why, in your own words.

  2. 02

    See the overlap

    Trustbird shows which requirements in each standard a control covers, so you know what is already in place.

  3. 03

    Attach evidence

    Add evidence to each control with its source and date. It counts for every linked requirement.

  4. 04

    Keep it valid

    Reminders tell owners when evidence is about to expire, so your file is current when the auditor arrives.

Frequently asked questions

What counts as evidence?
Anything that shows a control works in practice: a document, a screenshot, an export, a meeting record. You decide what fits your organization, and Trustbird records its source and date.
Why does the original date of evidence matter?
An auditor wants to know when something was true, not only when it was uploaded. Trustbird keeps both, so the history of your evidence is clear.
Does the AI decide whether evidence is sufficient?
The AI can give a judgement on whether evidence covers a requirement, but that judgement is advice with its own status. Only a person in your organization marks a requirement as met.

Related

See what Trustbird does for your organization

Trustbird is being built with two certified design partners, and we are looking for more companies to join them at co-founder pricing. Apply as a design partner, or mail us with a question.

Become a design partner support@trustbird.com