Forty attachments and a missing policy
Your consultant is preparing an assessment for a client: a certification assessment, a gap review against a standard, or a supplier assurance review the client's customer demanded. The first step is always evidence. You send a list: the information security policy, an asset register, a list of admin accounts, screenshots of certain settings, training records, and so on.
What comes back over the next three weeks is forty emails from four people at the client. Some attachments are named 'Document1.docx'. Some are the wrong policy. The asset register arrives twice, a week apart, with different numbers of laptops. One screenshot is taken on the wrong system. Your consultant saves them into a folder, renames them, and keeps a spreadsheet of what has arrived.
By the time the assessment starts, nobody is sure whether the evidence on file is the latest, and the consultant spends a morning confirming.
Your firm is also holding a pile of sensitive client documents in email and shared folders, which is not where a security firm wants them.
Why evidence collection drags
- Request lists are sent as a document, and the client replies by email in pieces.
- Several people at the client contribute, each sending their own attachments.
- There is no link between an attachment and the request item it answers.
- Versions arrive over time, and it is unclear which is current.
- Chasing is manual and depends on the consultant remembering.
What the email approach costs
| Problem | Cost |
|---|---|
| Evidence scattered in email | Consultant time spent filing and renaming |
| Versions unclear | Assessment based on the wrong document |
| Missing items found late | Assessment delayed |
| Manual chasing | Uneven, and depends on who is running it |
| Sensitive files in inboxes | Harder to control who can see them |
The cost also lands on the client relationship. A client who has sent the same asset register twice and then gets asked for it a third time starts to wonder how organised the firm assessing them really is, which is an awkward impression for a security firm to give.
The evidence portal we build
- Your consultants build request lists from templates per assessment type, adjusted for each client.
- The client gets a portal link with each item explained, and can assign items to colleagues, so the person who holds the asset register uploads it directly.
- Every upload is attached to a specific request item, with the uploader's name and the date. New uploads create a new version; old versions are kept.
- The consultant reviews each item and marks it accepted or needing more, with a comment the client sees.
- Missing and returned items are chased automatically on a schedule, with a summary to the client's lead contact.
- When the assessment starts, the consultant has a complete, versioned evidence set in one place. Retention and deletion follow the policy you set.
The portal runs in your environment, with access limited to named people, and we design storage and retention with you, given how sensitive client evidence is.
What your consultants get back
Evidence arrives against the right request, from the right person, with a date. The consultant reviews rather than files. Missing items are visible and chased without effort. And when a client comes back next year, their previous evidence and request list are the starting point, so they only update what has changed.
Clients prefer it too. One link, a clear list, the ability to hand items to colleagues, and a view of what is still needed.
Here is a typical run. The consultant picks the template for the assessment type, removes two items that do not apply to this client, and sends the link. The client's operations manager assigns the asset register to their IT lead and the training records to HR. Over the next fortnight uploads arrive against each item. The consultant returns one screenshot with a comment asking for the production system rather than the test one. The chaser goes out automatically for the two items still missing, and on the day the assessment starts, everything is in place with a date against it.
Signs you need an evidence portal
- Evidence requests are sent as a document and answered by email.
- Consultants spend time renaming and filing attachments.
- You have assessed against an out-of-date document.
- Chasing missing evidence is manual.
- Client evidence sits in inboxes and shared drives.