Compliance Evidence
An assessor doesn't grade your scanner. They grade your evidence, one objective at a time. I turn your scan and remediation data into evidence an assessor can follow, and I'm specific about where scanning stops being evidence at all.
The problem
Most organizations scan. Far fewer can show, for an assessment period, that the scans covered the right systems, logged in, ran at the defined frequency, and that each finding was fixed and re-verified or formally accepted. Missing evidence is not a clean result: a host the scanner couldn't log in to proves nothing, however short its finding list.
The gaps are rarely in the scanning itself. They're in the records around it: a scan frequency that lives in a draft procedure, an asset list that doesn't match the scan targets, tickets closed without a rescan, exceptions with no owner or expiry date. Each of those can fail an objective on its own, even when the program behind it is sound.
What I do
- Map your requirements to evidence. For each relevant requirement and assessment objective, what record shows it, where it lives, and who owns it.
- Close the gaps in the records. Authentication status, scan history, asset scope, remediation timestamps and rescan results, collected from the tools you already run.
- Build the evidence index. One place that links scope, scan runs, findings, tickets and verification, so a reviewer can trace any finding from detection to fix.
- Prepare your people. Assessors examine, interview and test. Your team should be able to run the report live and explain it.
- Fix the process, not just the file. Where a record is missing because a step is missing, I help you add the step, so the evidence keeps producing itself after I leave.
Frameworks
- NIST SP 800-171 / CMMC Level 2. Vulnerability scanning, remediation and flaw remediation (RA.L2-3.11.2, RA.L2-3.11.3, SI.L2-3.14.1), and the asset-scope evidence they depend on.
- HIPAA. Scan and remediation evidence that feeds the Security Rule's risk analysis and periodic evaluation.
- PCI DSS. Internal and external scan cadence, authenticated internal scanning, and rescans that show findings were resolved.
Where CMMC stands (as of October 2026)
In July 2026 the Department of War suspended the CMMC Phase 2 requirement for third-party (C3PAO) Level 2 assessments. Level 1 and Level 2 self-assessments, SPRS affirmations, and DFARS 252.204-7012 with NIST SP 800-171 Rev 2 still apply, and voluntary C3PAO assessments remain available. The suspension changes who checks your evidence and when. It doesn't change what the evidence has to show.
My CMMC status
I am not a C3PAO, and I don't perform or sell certification assessments. I'm not listed in the Cyber AB Marketplace as a Registered Practitioner or Registered Provider Organization. I prepare the evidence; a C3PAO or your own self-assessment decides the result.
What scanning can't prove
Scanning supports a handful of requirements directly. It says nothing about most policy, training, physical or personnel controls, and an assessment is never "passed" by scan data. I'll tell you which of your requirements the evidence covers and which it doesn't.
Deliverables and timeline
A requirement-to-evidence map, an evidence index, a gap register with owners, and a short briefing for the people the assessor will interview. Duration depends on the size of the environment and how much of the record already exists; the written scope gives the timeline.
Where this comes from
Over the years I've done this work for many organizations:
- Scan and remediation evidence for HIPAA, PCI DSS and SOC 2 audits.
- Programs mapped to NIST controls.
- Answers and evidence for cyber-insurance security questionnaires.
This is practical guidance on evidence, not legal advice.