Reviewing Automatically Gathered Evidence

In this article, you will find:

  • Key information regarding automated evidence gathering for Microsoft 365, Google Workspace and Cloud platforms within the OneClickComply platform.

Locating Automatically Gathered Evidence

When Technical tasks are completed using Fix this for me, the OneClickComply platform will automatically gather the necessary evidence to prove that the task/control has been implemented. The evidence will also automatically be linked to the relevant task and control, removing the need to manually gather or locate evidence.

To access automatically uploaded evidence, navigate to a task that was completed using Fix this for me, select the Review option, then scroll down past the Task Details & Manual Steps to the Evidence tab.

Accessing the evidence tab
Accessing Evidence tab

All evidence associated with chosen task will be displayed in this area.

Any evidence that has been automatically gathered by the OneClickComply platform will be labelled Automated Evidence Collection, with OneClickComply marked as the author.

Reviewing Automated Evidence

To review this evidence, click the ellipsis '...' button located to the right of the source and select View Evidence from the dropdown. This will open a side window displaying the gathered evidence.

Evidence Types

Automatically gathered evidence will be shown in one of two types, depending on the environment and the task. These are:

  • Video

  • Script

Note: For Google Workspace tasks, evidence is always provided in video format. For Microsoft 365 tasks, evidence may appear as either video or script-based output, depending on the specific automation being performed.

Video Evidence

Video evidence is a short recording of your environment that captures the required information for a given task. The length of the video depends on the complexity of the automation, but they typically range from around 15 seconds to just over a minute.

The content of each video will also vary by task. For example, one recording may simply show a setting being switched to “Enabled” while another may demonstrate a more detailed process, such as configuring firewall rules for managed devices.

You can find an example screenshot of video evidence below:

Example automated video evidence
Video-based automated evidence

Script Evidence

Script evidence provides a more technical view of your environment. Instead of a video recording, it displays the raw response from the Microsoft Graph API, showing which settings are configured and how they are set up.

This format is particularly useful for auditors, as it gives direct access to the underlying data that reflects your organisation’s compliance and security posture. It ensures that both you, and any auditors invited to the platform, can review the exact configuration details without interpretation or modification.

An example of script evidence output is shown below:

Automated script output example
Script-based automated evidence

This evidence can also be downloaded as an .html file, should you wish to bundle it with other evidence, or store it in a separate location. In order to create this file, click the Download button, located underneath the script evidence. You can then download this file from the File section of the evidence table of the task.

Automated Evidence for Cloud Platforms

For cloud environments, like AWS, Google Cloud Platform, or Azure, our platform operates with “read-only” access to ensure your security. Because of this access, automated evidence is gathered in the background rather than being displayed on the platform.

How to Manage Cloud Evidence:

To ensure your task is fully compliant, take a screenshot of the settings applied when you first configure them and upload that screenshot by clicking the Upload Evidence button in the relevant task. Once this initial proof is provided, our platform conducts a Continuous Monitoring scan every two weeks to verify that your settings remain in place. If a setting ever becomes non-compliant, the platform will flag it immediately, allowing you to re-enable the settings and upload a new screenshot to make the task compliant.

While our platform tracks this evidence in the background, these manual screenshots act as a visual backup, giving you an extra layer of protection during audits.

If you have any questions about automated evidence gathering, please contact a member of the support team.