154 held evidence requirements across 2 frameworks. Free to read.
What evidence does your audit actually need?
Read from the real rules, not invented. Every answer Evidence Binder gives points to the official rule behind it, so you can check any line yourself. Read from ISO 27001:2022 and SOC 2.
Read from the real rules154 held rules behind itCross-checked against 181 related standardsCheck any line yourself
Evidence Binder is a free, searchable library of the evidence an auditor asks for, held from the framework and cited to the clause. Start with ISO 27001:2022 and SOC 2: 154 requirements, 701 evidence records and 168 reviewed cross-framework mappings. Build your own request list free, or generate a full binder for USD 149.
See a sample binderFree and no account. Every requirement points to its clause; the site does not give legal advice.
Start with a framework
What is an evidence requirement?
An evidence requirement is the record an assessor expects to see for a control: the policy, the register, the log, the review or the approval. This library states the requirement in plain words, cites the clause it comes from, and lists the evidence records the held text describes for it.
Who is this for?
Compliance consultants and small GRC teams preparing a client for an ISO 27001 certification audit or a SOC 2 examination, and the people who assemble the evidence pack by hand. It replaces the blank spreadsheet with the requirement, the evidence and the cross-framework map already filled in.
How do the two frameworks line up?
Each page shows the reviewed mappings between the ISO 27001:2022 control and the SOC 2 criteria. 168 mappings survived refutation; each carries a confidence (high, medium or low) and the one-line reason. A mapping is a reading, not a proof: it does not establish that meeting one requirement satisfies the other, and it is not certification.
What is free, and what is paid?
The library and the request-list generator are free: every evidence page, the filterable index, and a personal evidence list you can download. The binder generator is USD 149 for a single framework, USD 399 for a multi-framework binder with the deduplicated evidence list, or USD 199 a month for consultants. See the pricing.
What the binder does, and does not do
The binder organises your evidence references, owners, review dates and the gaps against the requirements, with the source cited for each line, and exports a spreadsheet and a printable binder. It does not collect evidence for you, does not perform the audit and does not certify. See a sample binder.
The rules this is built from
Nothing here is invented. Evidence Binder reads the official rules listed below, by market, and every answer points to the one it came from. The same rules are cross-checked against related standards, the way a compliance team checks them.
Other
- ISO 27001:2022
123 controls across 11 domainsSee the standard - SOC 2
61 controls across 5 domainsSee the standard
184 controls kept in full. Cross-checked against 181 related standards.