How to Build an Evidence Pack That Actually Proves Your Security Works

Most businesses have a security policy. Almost none have organised evidence that the policy is actually being followed. That’s the gap this guide closes.

An evidence pack isn’t a compliance report. It’s a small, boring, well-organised set of screenshots, exports, and logs that let you answer “prove it” in under ten minutes, whenever the question comes from an insurer, a client, an auditor, or your own board.

Step 1: Create Five Folders

One per Cyber Essentials technical area: boundary firewalls, secure configuration, user access control, malware protection, patch management. That’s the whole structure. Resist the urge to make it more complicated than that.

Time: five minutes. Cost: nothing.

Step 2: Firewall Evidence

Screenshot your firewall’s active rule set and the date the screenshot was taken. If you’re using a cloud provider’s built-in firewall, export the configuration page directly rather than describing it in a document.

What this proves: your network boundary is actually configured, not just assumed to be.

Time: fifteen minutes. Cost: nothing if you already have admin access.

Step 3: Secure Configuration Evidence

Export your device configuration baseline, whatever platform you’re on. For Microsoft 365, this is your Intune or Endpoint Manager compliance report. For Google Workspace, it’s your device policy export. Screenshot the date alongside it.

What this proves: default settings have been reviewed and changed where necessary, not left as shipped.

Time: twenty minutes for a first export. Ten minutes on repeat.

Step 4: Access Control Evidence

This is the one most businesses get wrong, because “we have a password policy” isn’t evidence of access control. What you actually need: a current user list matched against active staff, an admin rights report showing who has elevated access and why, and if you’re using conditional access, a screenshot of the policy plus a recent sign-in log showing MFA was actually enforced.

If five people are sharing one login, this is where it becomes visible, immediately, because you won’t be able to produce a clean user list at all.

What this proves: only current, named, authorised staff can get in, and you can demonstrate that with a named audit trail.

Time: thirty minutes for the first pass, less if your identity setup is already clean.

Step 5: Malware Protection Evidence

Screenshot your endpoint protection dashboard showing coverage across your device fleet and the last successful update date for each device. Most platforms, Microsoft Defender, CrowdStrike, whatever you’re running, have a single-page summary view built for exactly this.

What this proves: protection isn’t just installed somewhere, it’s active and current everywhere.

Time: ten minutes.

Step 6: Patch Management Evidence

This is the weakest control nationally, sitting at just 34% adoption according to the government’s own Cyber Security Breaches Survey 2025/2026, so it’s worth getting genuinely right rather than faking it.

Export your patch compliance report, showing which devices are within your 14-day update window and which aren’t. If you don’t currently have a documented 14-day patching policy, write one now. It’s two sentences: security updates are applied within 14 days of release, and compliance is reviewed monthly.

What this proves: known vulnerabilities aren’t sitting open on your network for months at a time.

Time: fifteen minutes to export, one hour to write the policy if you don’t have one.

Step 7: The Backup Test

This one isn’t optional and isn’t covered by the five Cyber Essentials areas, but it’s the single most common gap we see in practice. A backup schedule is not evidence a backup works. Pick one system, restore it to a test location, and document that it worked, with a date and a screenshot of the restored data.

What this proves: your backup is actually a backup, not a folder quietly failing to sync for the last six months.

Time: one to two hours depending on system complexity. Do this quarterly, not once.

Step 8: Set a Quarterly Review Date

Put a recurring calendar entry, quarterly, to refresh every folder. Stale evidence is barely better than no evidence, because “this was true eight months ago” doesn’t answer “prove it” today.

Time: two minutes to set up. Ninety minutes per quarter to refresh.

What You’ve Built

Total time investment: roughly three to four hours for the first pass, then ninety minutes a quarter to maintain. Total cost: nothing, if you already have admin access to your own systems, which you should.

What you have at the end: a five-folder pack that turns “we take security seriously” into a ten-minute, evidence-backed answer to any question an insurer, client, board member, or Cyber Essentials assessor asks you.

How to Turn This Into a Competitive Advantage

A business that can produce this pack on request, during a sales conversation or a tender process, looks meaningfully different to one that offers reassurance alone. Increasingly, procurement teams are asking for exactly this kind of evidence before signing.

How to Sell This to Your Board

This costs almost nothing and takes an afternoon. That’s the strongest argument in the room: there is no budget conversation to have here, only a scheduling one.

It directly de-risks any future insurance claim, tender application, or Cyber Essentials assessment, all of which currently require exactly this evidence and currently catch most businesses unprepared.

What This Means for Your Business

1. Block three to four hours this week and build the five folders. Start with access control, since that’s where the most common failures hide.

2. Do the backup restore test before anything else if you haven’t tested one this year. It’s the single most consequential gap on this list.

3. Set the quarterly review reminder before you close this article. An evidence pack that’s a year out of date has almost none of the value of a current one.

4. If you’re preparing for Cyber Essentials specifically, do this first. Every assessor question maps directly onto one of these five folders, and having them ready before the assessment starts saves real time and money.

Source	Article
NCSC	Cyber Essentials overview and requirements
NCSC	10 Steps to Cyber Security
GOV.UK	Cyber security breaches survey 2025/2026