Change evidence · applies to GitHub, GitLab and Bitbucket connections

Where this happens

Once a VCS provider is connected (see GitHub, GitLab or Bitbucket), the Change Evidence page (Compliance Management → Change Evidence, or View repositories from VCS onboarding) is where you select repositories and run compliance scans.

Select repositories

  1. If the list is empty, go back to VCS onboarding and click Sync to fetch your repository list.
  2. Choose an organization to view its repositories — each shows a repository count and how many are selected.
  3. Tick the repositories to include in evidence collection (or use Select all), then click Save selection.

Run a scan

  1. Click Run scan. You'll see "Evidence scan started" and the report status shows In progress.
  2. When the report is ready, the status flips to Complete and the compliance report lists every scanned repository with per-control pass / fail / unknown results.

What the scan evaluates

Repository change-management posture is checked against the frameworks on your plan — ISO 27001, SOC 2, HIPAA, NIST 800-53, NIST 800-171, BSI C5, GDPR, ISO 27701 and ISO 42001 — producing the change-management evidence (how code review, branch protection and release discipline operate) that auditors sample.

Troubleshooting

  • "No repositories synced yet" — run Sync from VCS onboarding first.
  • Report stuck on Generating… — large selections take a few minutes; check back shortly.
  • Save selection disabled — there are no changes to save since the last selection.