The audit is in six weeks.
The auditor’s list has arrived. Some of it your CNAPP can answer. Most of it is policies, reviews and records that live in inboxes and shared drives, gathered by hand every year, by whoever is free.
You will recognise this if
- Your CNAPP’s compliance score looks fine, and the auditor’s request list is mostly things it cannot check.
- Evidence is screenshots in a shared folder, named by whoever took them.
- The same access review is collected three times: for PCI DSS, ISO 27001 and your regulator.
- Nobody can say which evidence will be out of date by the day the auditor arrives.
Most of an audit is not a scan result.
Split a framework by what can settle each requirement and it becomes clear why a good CNAPP score still leaves weeks of work. In PCI DSS, more than half the requirements can only be shown with evidence.
- A CNAPP policy checks it18
Your CNAPP has a policy that tests the setting the requirement asks for.
- Only an NxSCORE check covers it91
A setting can be tested, but the CNAPP has no policy for it. The NxSCORE scan does.
- Only evidence can show it140
Policies, reviews, training, contracts and procedures. A person has to show it was done.
From the product team’s own mapping of one widely used CNAPP, October 2026. The split is different for each framework, and the compliance page shows four of them.
First, know where every requirement stands.
Before collecting anything, find out what is already met, what is failing and what nobody has looked at.
- 01
Choose the frameworks in scope.
A workspace owner picks the frameworks your organisation is held to. NxSCORE keeps the current and the previous version of each, so a team mid-way through a version change sees both.
Every requirement is mapped to the NxSCORE checks that test it, the CNAPP policies that count towards it, and the evidence it needs when no check can settle it.
Frameworks in scope - 02
A status for every requirement, with the reason.
Each requirement says how it can be met: by checks, by checks plus evidence, or by evidence only. Then it shows where it stands: failing, evidence needed, in review, met, met by a compensating control, or not assessed.
A failing requirement lists the resources that fail it. A resource your CNAPP and NxSCORE both flag is counted once.
PCI DSS 4.0.1ExampleRequirement How it is met Status 1.3.1 Inbound traffic to the cardholder data environment is restricted Checks + evidence Failing 8.2.6 Inactive user accounts are removed or disabled within 90 days Checks + evidence Evidence needed 10.2.1 Audit logs are enabled and active Checks + evidence In review 12.1.1 An information security policy is established and published Evidence only Met 12.6.1 A security awareness programme is in place Evidence only Met by compensating control - 03
A workplan with a name and a date on each gap.
The workplan turns the gaps into jobs: each requirement still needed, who owns it, when it is due, and what else the same upload would cover. Your team can download it in Excel and work from it in the weekly meeting.
The failing requirements are ranked under Fix these first, so the fixes that clear the most requirements happen before the audit, not after it.
WorkplanExample- 8.2.6 Inactive accounts removed within 90 daysDue 28 Nov
owner: a.menon. One upload also covers ISO 27001 A.5.18.
- 1.3.1 Inbound traffic restrictedFailing, 6 resources
team: payments-platform. Fix kit ready for 4 of them.
Then collect the evidence once.
Most of the six weeks usually goes on collecting, chasing and re-collecting. This is where that work gets shorter.
- 04
One upload, counted everywhere it applies.
The same security policy answers a PCI DSS requirement, an ISO 27001 control and a NIST outcome. NxSCORE maps those requirements to each other, so the policy is uploaded once and counts for all three.
Before your analyst accepts an upload, they see every requirement it will meet. Nothing is counted somewhere your team did not expect.
Information security policy, v4.2Accepted- 12.1.1 Information security policyPCI DSS 4.0.1
- A.5.1 Policies for information securityISO 27001:2022
- GV.PO-01 Policy for managing cybersecurity risksNIST CSF 2.0
- 05
Checked by someone who did not upload it.
Your team is the maker: they write up what was done and attach the files. Your NxSCORE analyst is the checker. Nobody can accept their own upload, and an item that was returned goes to a fresh pair of eyes when it comes back.
Every file is checked for its real type, so a renamed program is refused. Each is stored with a hash and the name of the person who uploaded it.
Evidence: quarterly access reviewIn review- DraftWritten up by your team, with the files attached.
- In reviewWith your NxSCORE analyst, who can accept, return or reject it.
- AcceptedCounts towards every requirement it was mapped to.
- 06
Evidence with a use-by date.
Accepted evidence counts until the end of the quarter it was accepted in, plus 30 days. Before it falls due, the daily assessment tells your team, who renew it with fresh files for another review.
Evidence that lapses stops counting, and the requirement shows it. Six weeks out, you already know what will be stale on the day.
Evidence, due againExample- Firewall rule reviewAccepted
Counts until 30 January 2027.
- Security awareness training recordsQuarterly review due
Fresh files needed by 30 November 2026.
- Vendor risk assessmentsLapsed
No longer counted. 2 requirements back to evidence needed.
Then hand over what you already have.
On the day, the auditor reads the same record your team works from.
Nothing is assembled the night before. The pack is a download, and the auditor can check it against the live record.
- 07
The evidence pack, in Excel.
Any framework in scope downloads as one workbook. It is laid out the way an assessor reads: requirement by requirement, with the evidence beside it.
Its first sheet says plainly that it is not a report on compliance. Only a qualified assessor can issue one, and the pack is written to help them do it.
Evidence pack, PCI DSS 4.0.1Three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files - 08
A signed quarterly pack for the board and the regulator.
The quarterly pack covers the last four quarters: findings found and closed, the median time to fix, what was closed within its fix-by date and what is past it, what failed again after a fix, prevention plans, exceptions, and evidence accepted or waiting.
It can be laid out against RBI, IRDAI or SEBI clauses. When it is prepared, the workbook is frozen, so data that arrives later cannot change what was signed.
Board pack, Q3 2026Signed- PreparedBy your compliance lead. The workbook is frozen and its hash recorded.
- ReviewedBy a second person, who did not prepare it.
- ApprovedBy a workspace owner. The sign-off sheet names all three.
- 09
Read-only access for the auditor, with an end date.
Invite your auditor by email. They see what your team sees, cannot change anything, and lose access on the date you chose, no more than 180 days away.
Every page they open is in the access log, beside the NxSCORE staff who worked on your account. Exceptions are part of the record too: each one with its reason, who decided it and when it expires.
Access from outside your companyLast 90 daysRole Auditor, read-only Access ends 15 January 2027 Pages opened Every one, in the access log
Who does what.
Evidence is only worth something if the person who collected it is not the person who accepted it. The work is shared out so that is always true.
Your team
- Chooses the frameworks in scope
- Writes up and uploads the evidence, as the maker
- Owns each requirement on the workplan, with a due date
- Prepares, reviews and approves the quarterly pack, three different people
Your NxSCORE analyst
- Reviews every upload and accepts, returns or rejects it, as the checker
- Shows every requirement an upload will count for before accepting it
- Runs the quarterly sample for each asset in scope
- Keeps the checks and the CNAPP mapping current as frameworks change
Your auditor
- Gets read-only access that ends on a date you set
- Reads the same records your team works from
- Issues the report on compliance, which NxSCORE never does
NxSCORE does not certify, attest or issue a report on compliance. It keeps the record your assessor works from. See how each framework is mapped.
Questions teams ask about this.
Does NxSCORE make us compliant?
No tool can. NxSCORE shows where each requirement stands, collects the evidence, and keeps it current. Only a qualified assessor can issue a report on compliance, and every pack NxSCORE produces says so on its first sheet.
Which frameworks does it cover?
PCI DSS 4.0.1, ISO 27001:2022, NIST CSF 2.0, CIS Controls and the CIS benchmarks for AWS, Azure and Google Cloud, and GDPR. The quarterly board pack can be laid out against RBI, IRDAI or SEBI clauses. The current and previous version of each framework are kept, so evidence carries across a version change.
What does the auditor actually get?
Either a read-only login that ends on a date you choose, or the evidence pack in Excel: a summary, every requirement with how it is met and what is failing, and every piece of evidence with when it was accepted and when it is due again. Quarterly packs can be signed by three people and are frozen with a hash when prepared.
Who checks the evidence we upload?
Your NxSCORE analyst. Nobody can accept their own upload, and whoever returned an item cannot accept the resubmission. Each file is checked for its real type, stored with a hash and the uploader’s name, and can be up to 25 MB.
How long does accepted evidence count for?
Until the end of the quarter it was accepted in, plus 30 days. Evidence accepted in the last month of a quarter runs to the end of the next one. NxSCORE tells your team before an item falls due, and lapsed items stop counting.
We do not use a CNAPP. Does this still work?
Yes. The NxSCORE scan checks the settings, and evidence covers the rest. A CNAPP adds its findings when you have one, counted once with NxSCORE’s own.
Start with the framework you are audited on next.
Connect one cloud account and choose the framework. After the first assessment, your analyst takes you through where each requirement stands, what one upload would cover, and what will be out of date on the day.