Build Your ProgramEvidence & Tasks

Evidence & Tasks

The backlog of proof behind your controls, organized, assignable, recurring, and increasingly automated.

Evidence is what turns a claimed control into a proven one. In Aegis, evidence is produced by tasks: concrete, assignable pieces of work, many of which Aegis can complete for you from connected systems.

The evidence backlog

When your program is materialized, Aegis creates an evidence backlog mapped to your controls and grouped into categories, access rights, change management, backups, incident response, asset inventory, and so on. Instead of a wall of undifferentiated to-dos, you get a structured backlog you can work category by category.

Each task carries:

  • A status — to do, in progress, in review, done, not relevant, or failed.
  • An assignee — who owns producing the evidence.
  • A cadence — one-time, or recurring (for example quarterly access reviews).
  • Linked controls — so completing the task advances the controls, and therefore the frameworks, it supports.

Automated evidence

The evidence that used to be a screenshot taken the week before an audit can instead be collected continuously. Where a task can be satisfied by a connected system, Aegis pulls the evidence automatically:

  • Integrations collect configuration and state from the tools you run, identity, source control, HR, cloud (see Integrations).
  • Cloud tests check your AWS, GCP and Azure posture directly against the relevant controls.

Automated evidence means your posture is current between audits, not reconstructed for each one.

Working the backlog

A practical rhythm:

Assign owners

Give every task an assignee so accountability is unambiguous.

Set cadence

Mark recurring tasks with the right frequency so reviews and attestations regenerate on schedule rather than being forgotten.

Automate what you can

Connect systems and enable cloud tests so the mechanical evidence collects itself, leaving your team the judgment calls.

Track to done

Drive tasks through review to done. Progress rolls up through controls into live framework coverage.

The roadmap groups these same tasks into milestones and shows them on a status board, where moving a card changes the task itself.

Approval

If you want a second pair of eyes on evidence before it counts, turn on Evidence Approval in the Settings tab of the Evidence page. It is off by default. With it on:

  • A task is submitted for review with a named approver, and moves to In review.
  • Only the assigned approver can approve it, which marks it done. The approver (or an owner or admin) can reject it, which returns it to its previous status and keeps the same approver.
  • Tasks can't be marked done or sent to review directly. A task in review keeps its status until the approver decides.
  • Automated evidence goes to review too. When an integration check, an automation or an evidence template passes, the task is submitted for review instead of being marked done, and the banner says which automation submitted it.
  • Recurring tasks are re-certified. When a done task is due again, the next passing result sends it back to review rather than quietly extending it.

Who can approve

An approver is an active member whose role can update tasks. Auditors and read-only roles can't approve. NexusVoid staff who are members of your organisation can approve too, but automated reviews and "needs an approver" notices go to your own people first.

You can't approve your own submission, unless you are the only person in your organisation who can approve. In that case Aegis allows it and records it as a self-approval in the activity log.

If a review has no approver, for example because the approver left or lost the right role, the task page shows Needs an approver with a picker. Owners and admins can assign anyone eligible, including themselves; the person who submitted the review isn't offered unless nobody else can approve.

The rule is enforced by the Aegis API, not just hidden in the app. It applies the same way on the task page, the vendor and risk pages, the roadmap board, bulk status changes, API keys and the MCP update_task_status tool: any of them that tries to mark a task done directly is refused with a message to submit it for review instead. Other fields, such as the assignee or description, can still be edited.

With Evidence Approval off, anyone who can update a task can set its status directly, and a passing automated check marks its task done.

Documents

Alongside task-based evidence, Aegis maintains a documents checklist, the artifacts an auditor expects to see as standalone documents: meeting minutes, a penetration-test report, an architecture diagram, an access-request record. Each is tagged with the frameworks that ask for it and tracked to completion, so nothing an assessor routinely requests is a surprise.

The penetration-test report is one you can file without leaving Aegis: connect Striker and save a completed scan's report as penetration-test evidence in one click, with the current PDF fetched on demand whenever an assessor opens it.

Export

When it is time for an audit, evidence does not have to be assembled by hand. Aegis can export your evidence so you can hand an assessor a complete, organized package, or simply give them the auditor view and let them browse it live.

Next steps

Integrations

Connect systems so evidence collects itself.

Controls

What the evidence is proving.

Penetration Testing

Save a Striker scan report as pen-test evidence.

Team & Access

Assign tasks and give auditors a read-only view.

Capabilities

The full feature reference.

Contact us

Was this page helpful?