FAQs: Evidence Automation

Evidence Automation is currently available for the following frameworks:

• ISO 27001

• SOC 2

• GDPR

• HIPAA

If you don’t have the above frameworks, the Evidence Collection statuses will not appear.

The ignored test continues to appear in the Automation Sources section with an Ignored tag for audit visibility, but it no longer counts toward the automation status.

If the ignored test was the only active automation source for that evidence:

• The evidence collection status changes from Fully Automated or Partially Automated to Automation Ready.

If a monitor runs successfully but finds no data, its status shows No Data Found. The monitor is still considered active and counts toward the automation status. The evidence task remains at its current evidence collection status.

When you disconnect an integration:

• Automated Tests linked to that integration are hidden from the evidence task (but not deleted).

• Scrut Monitors from that integration become unhealthy.

• If no other active automation exists for the evidence, the automation status downgrades from Fully Automated or Partially Automated to Automation Ready.

• If no other data is attached to the evidence task, the evidence status reverts to Not Uploaded.

Once you reconnect the integration and it becomes healthy, the evidence task automatically returns to its previous automation status.

For manually added Scrut Monitors, the limit is three per evidence task. There is no limit for monitors that Scrut creates automatically.

The more evidence you can automate, the less time your team spends on repetitive compliance work. Automated evidence is:

• Always current: Updates automatically as your systems change

• Audit-ready: Available on demand without scrambling to collect documents

• Less error-prone: No risk of forgetting to collect or upload evidence

• Time-saving: Frees your team to focus on improving security rather than documenting it

However, it's normal to have a mix of automated and manual evidence. Not every piece of proof can be automatically collected, and that's okay. The Evidence Collection chart helps you understand which is which, so you can plan your compliance work efficiently.

The evidence status and the automated test status are independent of each other. Having a test linked to an evidence task does not affect the evidence status, regardless of whether that test is passing or failing.

The evidence status changes only when an automated test generates an export and that export is attached to the evidence task. Until that happens, the status reflects the state of the attachments alone, not the test results.

Heads Up! A failing test does not automatically mark the evidence as incomplete or change its status. Review the test result directly to understand what needs to be fixed, and check whether the test is configured to export and attach evidence.