Check out my evidence tagging system that made our auditor's life easier

infra_ops_guru · 2026-08-01T15:22:35Z

Having recently navigated a particularly rigorous SOC 2 Type II audit with Drata as our GRC platform, our engineering team identified a recurring friction point: the manual, often inconsistent, tagging of evidence during control tests. The auditor's experience, and by extension our own, was hampered by the need to hunt through vaguely named screenshots and documents to verify compliance narratives. To systematize this and embed compliance into our engineering workflows, we developed a lightweight, GitOps-driven evidence tagging system that integrates directly with Drata's evidence request API. The core principle is to treat evidence as immutable artifacts, versioned alongside the code that generates them, with metadata automatically injected. The system hinges on a simple but strictly enforced naming convention and a metadata sidecar file (JSON) generated for every piece of evidence. We use a combination of CI/CD pipelines (GitHub Actions) and a small Python CLI tool to enforce this. **Evidence Naming Convention:** `---.` *Example:* `CC6.1-terraform-plan-production-2023-10-27T14:30:00Z.png` **Key Metadata Sidecar (`evidence.json`):** ```json { "drata_control_id": 12345, "evidence_description": "Automated Terraform plan demonstrating no security group changes in production VPC.", "source_system": "github_actions", "environment": "production", "generated_at": "2023-10-27T14:30:00Z", "git_commit_hash": "a1b2c3d4e5f", "git_repo": "org/infra-live", "tags": ["terraform", "aws_security_group", "automated"] } ``` Our CI jobs for infrastructure changes (Terraform plan/apply), Kubernetes deployments, and security scans are now instrumented to capture the required evidence (screenshots, log snippets, policy outputs) and generate this sidecar file. A subsequent workflow step uses Drata's API to upload the evidence file and attach the metadata as a comment, using the `drata_control_id` to link it to the correct control. The tangible benefits we've observed: * **Auditor Efficiency:** Our auditor could search by control reference, environment, or git commit directly within the Drata evidence comments, drastically reducing verification time. * **Engineer Clarity:** The requirement is now a machine-checkable CI step. Engineers receive immediate feedback if evidence capture fails. * **Traceability:** Every piece of evidence is irrevocably linked to the specific code state and pipeline run that produced it, satisfying the "audit trail" requirement with zero additional overhead. * **Reduced "Evidence Debt":** Automated capture means evidence is gathered at the moment of change, preventing the last-minute scramble to backfill proof for quarterly tests. This approach shifts compliance left, from a periodic, manual documentation exercise to a continuous, automated byproduct of our normal engineering operations. While it required upfront investment to instrument our pipelines, the ROI was realized in the reduced audit preparation time and the increased confidence in our control state. --from the trenches

Page 4 / 4 Prev

Drata Reviews

Last Post by crm_pragmatist 2 months ago

46 Posts

44 Users

0 Reactions

241 Views

RSS

crm_pragmatist

(@crm_pragmatist)

Reputable Member

Joined: 4 months ago

Posts: 287

03/08/2026 2:32 pm

Good question. We treat the sidecar as part of the artifact bundle, so the whole thing gets a new version on any change. It's the only way to keep the audit trail clean.

If you let the sidecar float independently, you're asking for drift between the evidence and its description. Our rule is simple: if the metadata is wrong, the evidence is wrong. Version it together.

That said, we only allow additive changes. Corrections to the context tags or adding a new control ID are fine. But you can't retroactively delete a mapping that was submitted for a past audit period. That's a new artifact and a new version.

ReplyQuote

Page 4 / 4 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed