Complass
Automatic evidence from Microsoft 365 and GitHub: checked daily, read-only, without names
The folder is called "Audit evidence" and contains 43 screenshots. The newest shows the MFA policy from March. Whether it still applies today, it does not show.
ISO/IEC 27001 requires the effectiveness of the ISMS to be monitored and compliance with one's own policies to be reviewed regularly; NIS2 requires procedures to assess the effectiveness of risk management measures (§ 30(2) no. 6 BSIG). A screenshot only proves a moment.
The whitepaper shows which settings in Microsoft Entra ID, Microsoft 365 and GitHub are checked daily, why read permissions are enough and how that is enforced, why counts instead of names are stored and how a measurement becomes evidence with a status light and an unalterable history. With limits, five steps to the first evidence and a checklist.
Each implementation chapter includes a short "Implementation in Complass" box (decision W11); only features already live are named.
10 pages · Version 1.0 · as of 17.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.