---
title: "Generate evidence packs"
description: "Produce a fixed PDF of one framework's compliance posture over a closed audit period, download it, and check its digest before you hand it over."
url: "https://support.outpostplatform.com/compliance/evidence-packs/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "How to generate a compliance evidence pack in the Outpost console under Compliance > Evidence packs. One framework, one closed period of at most 366 days, rendered once as a PDF and never regenerated. Contents: posture by control, both audit chains' verification, policy snapshots, and exceptions. Needs compliance:manage and storage. SHA-256 digest, retention."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "compliance:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/compliance/evidence-packs.md"
license: "CC BY 4.0"
---

# Generate evidence packs

An evidence pack is a PDF that states one framework's compliance posture over
one audit period, with the records behind it. Outpost renders it once, stores
it, and never regenerates it, so the document you give an auditor in July is
the same document you can produce for them in October. Generate one at the end
of each audit period.

## What a pack contains

| Section | What it holds |
| --- | --- |
| Posture | The framework's posture control by control, with the verdict counts beside every percentage. |
| Audit chains | The verification result of both tamper-evident audit records, **Console actions** and **Endpoint changes**. A broken chain is printed as a finding, not hidden. See [Audit logs](/depot/audit-log/). |
| Policy snapshots | The signed policy versions endpoints verified during the period, by hash. |
| Exceptions | The exceptions in force or decided during the period, with justification, requester, approver, and decision dates. |

A pack for an advisory framework, such as DISA STIG, is a gap analysis and not
a compliance claim. The document says so, and the list marks it **advisory**.

## Before you begin

- You need `compliance:manage` to generate a pack. Anyone with
  `compliance:read` can list and download packs.
- Your Outpost needs a storage destination, because packs are stored as
  files. See [Storage](/depot/storage/).
- The period must have ended. A pack describes a closed period and is never
  regenerated, so it cannot cover days that have not happened yet.
- A pack covers at most 366 days. Generate one pack per audit period.

## Generate a pack

1. Select **Compliance** > **Evidence packs**.
2. Select **Generate a pack**.
3. In **Framework**, choose the framework.
4. In **Period start** and **Period end**, choose the first and last day of
   the audit period. The pack covers both days in full.
5. Select **Generate**.

The console confirms with **Evidence pack requested.** and the pack appears in
the list. Generating a pack is recorded in the audit log with your name.

You can generate more than one pack for the same framework and period, for
example one before and one after you fix a control. Each is a separate
document, and both stay in the list.

## Download and check a pack

1. In the pack's row, select **Download**. The PDF downloads with a file name
   that names the framework and the period start.
2. Compare the file's SHA-256 digest with the **Digest** column. The column
   shows the first 12 characters. Hover over it to see the whole digest.

   **On Windows**, run:

   ```powershell
   Get-FileHash -Algorithm SHA256 <pack-file>
   ```

   **On Linux or macOS**, run:

   ```bash
   sha256sum <pack-file>
   ```

   Replace `<pack-file>` with the path of the downloaded PDF. The two digests
   match when the file is the one Outpost produced.

The list's **By** column shows the user ID of the person who generated each
pack.

## How long packs are kept

Packs are kept for the number of days in the `compliance.evidence_retention_days`
profile setting, 365 by default, and then deleted. A declared framework can
raise that period. HIPAA, for example, raises it to 2,190 days. See
[Compliance framework baselines](/compliance/framework-baselines/). Download
any pack you must keep longer.

## Verify

The new pack is listed with its framework, period, generation time, size, and
digest, and **Download** returns a PDF whose digest matches the **Digest**
column.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| **The period has not ended yet. An evidence pack describes a period that has closed, and it is never regenerated.** | The period end is in the future. | Choose an end date of today or earlier. |
| **A pack may cover at most 366 days. Generate one pack per audit period rather than one for the whole history.** | The period is too long. | Split it into audit periods. |
| **Evidence packs need storage, and no storage profile is configured on this Depot.** | Your Outpost has no storage destination. | Add one under **Settings** > **Storage**. See [Storage](/depot/storage/). |
| **Generate a pack** is unavailable | You do not hold `compliance:manage`. | Ask an owner or Support Manager. |

## Next steps

- [Request and approve exceptions](/compliance/exceptions/)
- [Audit logs](/depot/audit-log/)