Skip to content

Export compliance evidence

Give an auditor a signed copy of how your tenant stands against one compliance pack today, which they can verify offline.

Who can do it

Every built-in tenant role, and the platform roles working inside the tenant: the export needs the permission to read the tenant's analytics. The console shows the download only to a person who holds it.

Before you start

  • The deployment licence includes the pack. Evidence already issued for a pack the licence no longer includes still verifies, but new evidence cannot be issued.

Steps

  1. Open Compliance evaluation in your tenant's navigation.
  2. On the pack's card, select Evidence package, or select View detail and plan and then Download evidence package on the pack's page.
  3. Save the ZIP file and give it to your auditor.

  4. When the auditor needs the files on their own, use Individual files below the package download on the pack's page:

    • Download signed evidence saves compliance-evidence-<packId>-<day>.jose.json, the signed evidence alone.
    • Download verification keys saves compliance-evidence-verification-keys-<installationId>.json, the deployment's public verification keys.

    Give the verification keys to the auditor through a channel other than the evidence: a key that arrives with the evidence cannot prove who issued it.

What you see when it worked

The browser saves one ZIP file holding:

  • report.pdf: the evaluation as a report for people to read, in the console's language.
  • evidence.jose.json: the signed evidence, signed by the deployment with ML-DSA-65. This is the authoritative file.
  • cbom.cdx.json: your tenant's live keys and their algorithms, in CycloneDX.
  • verification-keys.json: the public keys the signature is checked with.
  • README.txt and SHA256SUMS: how to verify the package, and the checksum of each file.

The package is produced when you download it and is not kept: each download is a new package, and each one is recorded in your audit trail. An auditor should obtain the verification keys through a channel other than the package itself before trusting it.

If it fails

What you see Cause What to do
The evidence package could not be downloaded, with a wait in seconds The service prepares one package at a time and is busy with another Retry after the wait the console shows
The evidence package could not be downloaded, refused as too large The tenant holds too many live keys for one package Ask your platform administrator
The evidence package could not be downloaded, because the pack is not licensed The licence no longer includes the pack Contact your platform administrator
The evidence package could not be downloaded, because the licence could not be read or the installation identity could not be verified The licence service could not answer or sign Retry later; if it persists, tell your platform administrator
The server's response named no file, so nothing was saved. The response carried no file name Retry the download
The signed evidence could not be downloaded, or The verification keys could not be downloaded, with the server's detail The same causes as the package, for that file Act on the detail shown, then select Retry

Without the console

Surface How
Key management CLI No command
Admin SDK Not available
API GET /api/v3/admin/tenants/{tenantId}/compliance-evidence/{packId}/package (operation exportComplianceEvidencePackage), the package the console downloads; GET …/compliance-evidence/{packId} with Accept: application/jose+json (operation exportComplianceEvidence), the signed evidence alone; GET …/compliance-evidence/verification-keys (operation getComplianceEvidenceVerificationKeys), the deployment's public verification keys