Generate evidence packs

View as Markdown Open in ChatGPT Open in Claude

An evidence pack is a PDF that states one framework’s compliance posture over one audit period, with the records behind it. Outpost renders it once, stores it, and never regenerates it, so the document you give an auditor in July is the same document you can produce for them in October. Generate one at the end of each audit period.

What a pack contains

Section	What it holds
Posture	The framework’s posture control by control, with the verdict counts beside every percentage.
Audit chains	The verification result of both tamper-evident audit records, Console actions and Endpoint changes. A broken chain is printed as a finding, not hidden. See Audit logs.
Policy snapshots	The signed policy versions endpoints verified during the period, by hash.
Exceptions	The exceptions in force or decided during the period, with justification, requester, approver, and decision dates.

A pack for an advisory framework, such as DISA STIG, is a gap analysis and not a compliance claim. The document says so, and the list marks it advisory.

Before you begin

You need compliance:manage to generate a pack. Anyone with compliance:read can list and download packs.
Your Outpost needs a storage destination, because packs are stored as files. See Storage.
The period must have ended. A pack describes a closed period and is never regenerated, so it cannot cover days that have not happened yet.
A pack covers at most 366 days. Generate one pack per audit period.

Generate a pack

Select Compliance > Evidence packs.
Select Generate a pack.
In Framework, choose the framework.
In Period start and Period end, choose the first and last day of the audit period. The pack covers both days in full.
Select Generate.

The console confirms with Evidence pack requested. and the pack appears in the list. Generating a pack is recorded in the audit log with your name.

You can generate more than one pack for the same framework and period, for example one before and one after you fix a control. Each is a separate document, and both stay in the list.

Download and check a pack

In the pack’s row, select Download. The PDF downloads with a file name that names the framework and the period start.
Compare the file’s SHA-256 digest with the Digest column. The column shows the first 12 characters. Hover over it to see the whole digest.

On Windows, run:
Terminal window
```
Get-FileHash -Algorithm SHA256 <pack-file>
```
On Linux or macOS, run:
Terminal window
```
sha256sum <pack-file>
```
Replace <pack-file> with the path of the downloaded PDF. The two digests match when the file is the one Outpost produced.

The list’s By column shows the user ID of the person who generated each pack.

How long packs are kept

Packs are kept for the number of days in the compliance.evidence_retention_days profile setting, 365 by default, and then deleted. A declared framework can raise that period. HIPAA, for example, raises it to 2,190 days. See Compliance framework baselines. Download any pack you must keep longer.

Verify

The new pack is listed with its framework, period, generation time, size, and digest, and Download returns a PDF whose digest matches the Digest column.

If something goes wrong

Symptom	Cause	Fix
The period has not ended yet. An evidence pack describes a period that has closed, and it is never regenerated.	The period end is in the future.	Choose an end date of today or earlier.
A pack may cover at most 366 days. Generate one pack per audit period rather than one for the whole history.	The period is too long.	Split it into audit periods.
Evidence packs need storage, and no storage profile is configured on this Depot.	Your Outpost has no storage destination.	Add one under Settings > Storage. See Storage.
Generate a pack is unavailable	You do not hold `compliance:manage`.	Ask an owner or Support Manager.

Next steps

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.