The 90-day audit
A customer security audit arrives. The deadline is non-negotiable. The evidence package needs months of organization that does not exist. Contracts have been lost this way.
Evidence by Design · A Foundation Service
When an auditor or insurer asks for proof, your answer should already be prepared.
Evidence by Design (EbD) is EmpowerIT's continuous compliance documentation methodology. Instead of scrambling to assemble evidence when an audit clock starts, EbD maintains a current Compliance Posture document at all times. The report is updated each operating quarter as part of the managed service. Ready for customer auditors, insurance underwriters, regulators, or M&A diligence.
01 / The problem EbD solves
Most businesses discover their documentation gaps when it is already too late
The four scenarios we built EbD to prevent.
"I think it's somewhere"
The IT team knows what they have configured, but the documentation is in someone's head, scattered across emails, or genuinely missing. The auditor wants paper.
The customer who walked
A long-standing customer requires SOC-style attestation from suppliers. Without an evidence package, the relationship cannot be maintained.
The insurance non-renewal
The cyber liability carrier reviews posture at renewal. Without evidence, the policy reprices significantly, gets restricted, or does not renew.
02 / Methodology
Three steps, run continuously
Collect. Organize. Report. Always current.
01
Collect
Continuous evidence gathering from monitoring platforms, patch management systems, backup test results, access control logs, and SOC threat events. No manual assembly required. The collection happens as a side effect of the managed service operating.
02
Organize
Structured documentation across six compliance domains. Each domain has a defined evidence schema. New evidence files into the right slot automatically. The structure is the same whether the audience is a customer auditor, an underwriter, or an internal board reviewer.
03
Report
A single Compliance Posture Report, current as of the operating quarter, written for a business audience. Not an auditor's deliverable. Not a technical brain dump. A clear document that can be handed across, read, and understood without translation.
03 / Domains covered
Six compliance domains, one quarterly report
What's inside the Compliance Posture Report.
Network & Infrastructure
Topology, hardware inventory, configuration baselines, change history, redundancy posture.
Security Operations
SOC logs, threat events with response times, blocked attacks, threat intelligence sources, incident response activations.
Patch Management
Patch compliance per device, patch cadence vs published vulnerabilities, exception tracking.
Access Control
Access matrix per system, privileged access review, MFA coverage, dormant account hygiene, off-boarding evidence.
Backup & Recovery
Backup posture, test results, recovery time objectives validated quarterly, evidence of actual restore exercises.
Policies & Procedures
Policy inventory, version control, employee acknowledgment evidence, incident response playbook, business continuity documentation.
04 / Built for businesses with someone watching
Who EbD is for
EbD is built for businesses that answer to someone else about security.
Manufacturers
Customer cybersecurity audits cascade through the supply chain. OEMs push compliance to primes. Primes push to subs. The evidence package determines whether contracts renew.
Accounting firms
CRA scrutiny, FINTRAC obligations, provincial CPA body audits, PIPEDA on client data, and client SOC reports for the auditor's auditor chain. The evidence requirements are multi-layered.
Professional services
Legal firms with privilege obligations. Engineering firms with controlled-goods exposure. Any practice where client confidentiality is a contractual and regulatory requirement.
Insurance renewers
Any business going through a cyber-liability renewal in the current carrier hardening cycle. The questionnaire is harder every year. EbD answers it.
EbD in the offering ladder
EbD is the operational expression of the Foundation's audit-readiness discipline.
Evidence by Design is not a separate product layer. It is what the Foundation services produce when they are operated to the EmpowerIT standard. The same SOC, monitoring, patch management, and access control that satisfies your customer audit produces the evidence package the audit asks for. The methodology turns operational discipline into a deliverable document.
Free Gap Analysis includes sample EbD report