Provided by ServLogi
Request these through the Client Portal under Compliance. Most are available immediately. Assessment reports require a signed non-disclosure agreement and take a few business days.
- The current control responsibility matrix for your boundary.
- The most recent assessment report and continuous monitoring summary.
- Physical security evidence for the facilities in your deployment regions.
- Secure erasure records for any servers you have decommissioned.
- Platform audit log extracts covering your boundary for the assessment period.
Provided by your team
Your team is responsible for producing these. Keeping them current throughout the year avoids delays during assessment.
- Application audit logs covering the assessment period, with evidence they were reviewed rather than merely retained.
- Operating system configuration baselines and evidence of drift monitoring.
- Your account management records, including evidence of periodic access review.
- Backup restore test results. An untested backup is considered a finding.
- Patch records for the operating system and application layer.
Access review evidence is the most common gap. Reviews often take place but are not documented, and an undocumented review cannot be distinguished from one that did not occur.
Timing
Request ServLogi evidence at least three weeks before fieldwork begins. Assessment reports require a non-disclosure agreement, and the legal review involved is the most common source of delay.
If your assessment date is fixed and approaching, contact your deployment engineer directly rather than submitting a portal request.