Contact

Use case · Evidence

Audit evidence: from operations, not from spreadsheets

Before every audit, the same routine: Excel lists get updated, screenshots collected, reports written up. XMfortress turns this around – the evidence is produced along the way while the platform does its work.

Updated on November 14, 2026

Female security chief at the window of an office overlooking the city

FIGAudit Evidence

What evidence auditors expect

  • An up-to-date inventory of assets with owners (ISO/IEC 27001 Annex A 5.9)
  • A defined process for handling technical vulnerabilities, including deadlines (A 8.8)
  • Detection, handling and reporting of incidents
  • Proof that controls are effective (performance evaluation, clause 9)

Evidence is produced continuously

Every discovery, assessment, task and re-test is recorded in XMfortress with a timestamp. This produces reports with history: How has the attack surface developed, how many critical vulnerabilities were open and for how long, which validations ran and with what result?

Management reporting in plain language

Under NIS2, management must approve and oversee security measures. That does not require log lines but a clear picture of the situation: exposure score, trend, open critical risks and deadline compliance – easy to understand and comparable over time.

For several frameworks at once

The same data supports requirements from ISO/IEC 27001, NIS2 and DORA. Instead of three separate evidence projects, one data foundation is enough.

01Audit Evidence

Evidence and sources

EvidenceSource in XMfortress
Asset inventory with owners Surface
Vulnerabilities, deadlines, remediation Vuln
Effectiveness of controls Validate
Detected incidents and response Detect, Respond

02Platform

Related products

  1. 01ExposureSurfaceAttack Surface Management
  2. 03ExposureVulnVulnerability Management
  3. 04ExposureValidateSecurity Validation
  4. 05Detect & RespondDetectSecurity Monitoring

03FAQ

Frequently asked questions

Does XMfortress replace an ISMS tool?

No. XMfortress provides the technical evidence; you continue to maintain policies, risk treatment plans and responsibilities in your ISMS.

How far back does the history go?

From go-live, all assessments and actions are stored with a timestamp, so trends can be shown over months.

Can auditors get direct access?

Reports can be exported and shared with auditors; we are happy to arrange dedicated read-only access with you.

Aerial view of a city at night with illuminated streets

Know your exposure.
Control your risk.

4Contact

Talk to us about your attack surface, your priorities and the right way to get started with XMfortress.

Get in touchExplore the platform