Evidence by Design is our proprietary methodology for maintaining compliance documentation continuously — so when the request comes, your answer is already prepared.
The email arrives. A customer security questionnaire — 400 questions. An insurer demanding proof of controls before they'll renew your policy. A regulator asking for evidence you didn't know you needed to keep.
You forward it to your IT provider. They go quiet. A week later they ask you for information you don't have. Network diagrams from three years ago. Patching records that were never kept. Security policies that don't exist.
The deadline ticks down. The relationship — with your customer, your insurer, your regulator — hangs in the balance.
As part of our annual supplier review, please complete the attached cybersecurity questionnaire and provide supporting evidence for each control area:
Evidence by Design is the methodology we use to maintain every piece of documentation an auditor, customer, or insurer might request.
It's a continuous process woven into how we operate your IT environment every single day — captured automatically, organized in one place, and ready the moment someone asks.
Our platform captures evidence automatically through daily operations. Every applied patch is logged. Every blocked threat is recorded. Every configuration change is documented.
We don't ask your team to maintain spreadsheets or remember what was done. The system captures it.
The evidence is structured within our secure documentation platform — organized by category, cross-referenced, and searchable.
No scattered files. No "I think it's in a folder somewhere." Everything in its place.
When an auditor, customer, or insurer requests evidence, we generate a structured report from the current documentation.
Not a panic project. Not a fire drill. A standard output of how we operate.
When evidence is requested, you receive a professional, structured report that answers the core questions auditors and insurers ask.
Your auditor understands it. Your insurer understands it. Your customer's procurement team understands it. You don't need to translate IT jargon.
We've walked into businesses where the previous IT provider kept everything in their head. No documentation. No records. No evidence that anything had ever been patched, secured, or tested.
When the audit request came, the scramble was painful. In one case, a manufacturer nearly lost their largest customer because they couldn't produce basic security evidence within a 90-day window.
We turned it around — barely. But we recognized that the entire crisis was unnecessary. The evidence should have existed all along.
Evidence by Design. The proof is already there. Because we built it that way.
Manufacturer given 90 days to produce evidence. Previous provider had nothing organized. We rebuilt the package — and the methodology — from scratch.
Backup logs that nobody had ever checked. Patching records that didn't exist. A binder full of policies dated 2017.
A six-figure contract under review because the supplier couldn't answer six questions. The supplier had answers — they just couldn't prove them.
Cyber insurance declined because "we have antivirus" no longer cleared the bar. The renewal questionnaire is now a security audit.
Whose customers require cybersecurity verification before awarding or renewing contracts.
Facing increasing data protection expectations from CPA Canada and privacy regulators.
Any firm whose clients trust them with sensitive data and expect proof of protection.
Any business renewing cyber insurance and discovering "we have antivirus" is no longer a sufficient answer.
The request arrives. You forward it to your IT provider. They go silent for a week. Then they ask you to fill in the gaps yourself.
You spend evenings and weekends hunting for information that should already exist. The deadline approaches. The submission is incomplete. The customer puts your contract under review. The insurer declines to renew.
Request a free IT Assessment. We'll evaluate your current environment and show you what an Evidence by Design report would contain for your business — the structure, the categories, and the gaps. So you know exactly where you stand.
No charge. No pitch. Just clarity.