evidence-request-list
Skill2 starsChanged 14 days agoMITView on GitHub
Generate a deduplicated, control-mapped evidence request list and evidence tracker (CSV) for ISO 27001, SOC 2, Cyber Essentials Plus, GDPR and ISO 42001 — with owners, source systems, frequency and due dates, so one artefact satisfies multiple frameworks. Use for "evidence list", "PBC list", "what evidence do we need", "prepare for the auditor", "evidence collection plan", or "set up evidence tracking".
1 other project uses a version of this, 1 of them edited.
Adopted by
Most recently taken up by
- grcmana/grc-osedited, first seen Nov 8, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 1
- grcmana/grc-os★ 299% same
Wrote their own version · 0
None found.
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository11 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- ai-impact-assessmentSkill
- audit-readinessSkill
- company-contextSkill
- cyber-essentials-scopingSkill
- dpiaSkill
- evidence-reviewSkill
- grc-statusSkill
- policy-gap-reviewSkill
- policy-writerSkill
- risk-registerSkill
The file
We split this skill into the rules it gives an agent
3 rules. About 0 are common, 2 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 17
Read references/grc-workspace.md and references/evidence-standards.md first.
- Distinctive: line 49
Don't request evidence for controls the organisation has excluded, e.g.
- Distinctive: line 50
Use the auditor's wording only when the user supplies it (pbc mode).
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Evidence Request List
You produce the evidence plan: exactly what to collect, from which system, by whom, how often, and for which requirements. Collect once, use many times.
Read references/grc-workspace.md and references/evidence-standards.md first.
Modes
- plan: build the evidence tracker for the selected frameworks and the audit type. This is the default.
- pbc: turn an auditor's "provided by client" (PBC) request list, which the user supplies, into a tracker with owners and the sources mapped.
- refresh: roll the tracker forward to a new period: reset status, keep recurring items, update due dates.
Context
Read:
grc/context/company-profile.md, for the frameworks, tooling (source systems) and ownersgrc/audits/readiness-*.md, if present, to focus on the gaps
Plan workflow
- Identify the requirements in scope for the selected frameworks and audit type, using the framework packs.
- Group by domain (
references/crosswalk.md), and write one evidence request per real artefact, mapped to every framework it serves. Example: "IdP export of all users with MFA status" maps toISO27001:A.5.17,A.8.5; SOC2:CC6.1; CE:User access control. - Make each request specific and collectable:
- name the source system from the profile, e.g. "Google Workspace Admin → Users → export with 2SV status", not "identity system"
- state the period or date required (Type II: full period with samples; Stage 1: current)
- state the frequency (one-off, per event, monthly, quarterly, annual)
- name the owner (role)
- set a due date, working back from the audit date
- Mark population-based items, e.g. "list of all leavers in the period with their termination date". Auditors sample from these.
- Flag automation candidates: evidence that could later be pulled via API or connector (IdP, cloud config, ticketing, MDM, code host).
Outputs
grc/evidence/evidence-tracker.csv, using the columns inassets/evidence-tracker-template.csv. IDs areE-001… and are never renumbered.grc/evidence/request-list-YYYY-MM-DD.md: a human-friendly list grouped by owner, so you can send each owner their section.- A summary in chat: the total number of requests, the count deduplicated across frameworks, the top owners by load, the earliest due items, and the automation candidates.
- A run log in
grc/runs/.
Guardrails
- The tracker stores locations, not the evidence itself. Never paste secrets or personal data into it.
- Don't request evidence for controls the organisation has excluded, e.g. ISO SoA exclusions or SOC 2 categories not selected.
- Use the auditor's wording only when the user supplies it (pbc mode). Otherwise paraphrase the requirements.
References
references/grc-workspace.mdreferences/evidence-standards.mdreferences/crosswalk.md- Framework packs:
references/iso27001.md,soc2.md,cyber-essentials.md,gdpr.md,iso42001.md
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.