The Merkle root summary made our auditors stop asking for raw screenshots. That single change saved us an exhausting week.
Back to all solutions
Audit Reporting
Audit Evidence Vault
A tamper-evident store for endpoint compliance evidence, scoped to the windows your regulators actually ask about.
What it does
Evidence preparation usually begins three weeks before an audit and ends with screenshots in a shared drive. The Vault collects evidence continuously, hashes it on capture, and presents it in regulator-ready bundles scoped to the ISMS-P or FSS audit window. Internal Audit gets read-only access on day one, not on request day.
Inclusions
- Continuous capture across endpoint, identity, encryption, and patch domains
- Per-record SHA-256 hashing with a daily Merkle root for the audit window
- One-click export bundles scoped per regulator request (FSS, FSC, internal)
- Five-year retention default with role-based redaction for personally identifiable data
- WORM archival into S3-compatible object stores or on-prem MinIO
Outcomes after rollout
- 01 Audit preparation time reduced from three weeks to roughly four working days
- 02 Eliminate the screenshot folder workflow for endpoint evidence
- 03 Retention policy enforced automatically rather than as a quarterly review
Common questions
The default configuration was reviewed against ISMS-P and FSS Cyber Resilience guidance and uses WORM-style storage with hash chaining. We do not, however, provide a legal opinion — your CISO and external counsel still own the determination.
Yes. The Vault writes to your S3-compatible bucket or on-prem MinIO using your keys. CrestNode never needs to retain a copy.
Below roughly 200 endpoints the Vault is technically excessive — a simpler quarterly capture serves you better. We will say so on the discovery call.
From clients
Lead on this module
Park Min-seo, Endpoint Automation Engineer
Writes the playbook layer that turns evidence-gathering scripts into reliable, auditable runs across Windows, macOS, and branch-fleet kiosks.
Schedule a scoping call
No obligation. KR business hours, English or Korean.