--- schema_version: "1" id: 6ad9a57607f0a244d2178de962b4ed3686218c6ce1777b5e28d786a8daf9abbe title: Evidence Management Lifecycle for IT Compliance collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_evidence_mgmt_lifecycle.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_evidence_mgmt_lifecycle.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 8d8ee8f8e2febb3ac012ef746c05309bdc70c076d2ba7499ebbc9b5e32c40f03 description: Follow how compliance evidence moves from audit planning to external review. See how audit managers, fulfillers, compliance reviewers, and auditors work together to collect, verify, and lock evidence in a traceable workflow. products: - Service Cloud - Agentforce IT Service release: "264" --- # Evidence Management Lifecycle for IT Compliance Follow how compliance evidence moves from audit planning to external review. See how audit managers, fulfillers, compliance reviewers, and auditors work together to collect, verify, and lock evidence in a traceable workflow. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, Performance, and Unlimited Editions with Agentforce IT Service.
Follow the lifecycle of a compliance evidence request to see how status transitions, artifact verification, and role-based ownership work together to create an auditable trail from evidence collection through external review. ## Planning and request creation Cumulus Bank's audit program manager creates a Compliance Audit record for the upcoming review: **GMRI-2026 Resilience & Storage Compliance Audit - Q3**. The audit type is set to **Internal Audit**, the observation window runs from July 1 through September 30, and the execution window is October 5 through October 15. Under this audit, the manager creates an evidence request: **Provide proof that all production S3 buckets use server-side encryption**. The request is assigned to Jordan Chen, a cloud infrastructure engineer, with a due date tied to the audit timeline. The manager advances the request status from **Draft** to **Sent to Client**, which sends Jordan a notification and adds the request to Jordan's Evidence Hub queue. ## Fulfillment and artifact creation Jordan goes to the Evidence Hub app and opens the assigned request. Reading the instructions, Jordan understands that the auditor needs an export showing encryption settings for all production S3 buckets. Jordan creates a new evidence artifact on the request: **AWS S3 Bucket Encryption Configuration Export**, and sets the classification to **Confidential**. After pulling the configuration export from AWS Config, Jordan uploads the CSV file to the artifact's **Files** tab and changes the artifact status from **Draft** to **Submitted**. The compliance team is notified that the evidence is ready for review. ## Review and verification Rachel Anderson, the IT compliance analyst, opens the artifact from the evidence request's **Artifacts** tab. She clicks into the **Files** tab and opens the CSV in the evidence artifact previewer, which renders the file inline without requiring a download. Scanning the export, Rachel confirms that every production bucket in the list shows **Encryption: AES-256**. Satisfied that the evidence meets the compliance requirement, Rachel sets the artifact status to **Verified - Accepted**. The artifact record and all attached files immediately lock, becoming read-only. No further edits to the artifact or its files are allowed. ## Rejection and resubmission In an alternate scenario, suppose Rachel's review reveals that three buckets in the us-west-2 region show no encryption. Rachel sets the artifact status to **Verified - Rejected** and fills in the **Observation Statement** field with feedback: **3 buckets in us-west-2 region show no encryption (bucket-analytics-staging, bucket-logs-raw, bucket-temp-uploads). Please remediate and resubmit evidence after encryption is enabled.** Jordan receives a notification, remediates the encryption gaps, pulls a fresh AWS Config export, and creates a new artifact with the corrected evidence. This time, Rachel verifies that all buckets are encrypted and accepts the artifact. ## Request closure Once all artifacts linked to the evidence request have been verified and accepted, the audit program manager marks the request itself as **Accepted**. The request, all its linked artifacts, and the parent audit remain accessible for reporting and external review. ## Audit trail and external review When the external auditor arrives to perform the compliance audit review, they sign in to the Evidence Hub with a user account that has read access to the compliance records. The auditor navigates to the compliance audit's **Evidence** tab and reviews each evidence request and its verified artifacts. They open Jordan's S3 encryption artifact, preview the CSV inline, and see the same evidence Rachel accepted. Because the artifact was locked at the moment of verification, the auditor has confidence that the file hasn't been altered since the compliance team approved it. The full artifact history—who submitted it, when, who verified it, and any rejection feedback—provides a complete chain of custody that satisfies the compliance reporting requirements.