Help centre
How Evidence Is Shared, Stored and Returned During an Engagement
Share the least evidence that answers the question, through access you can revoke, with personal data redacted wherever it is not the thing being tested. In a SecureRoot engagement, what is in scope, which accounts and data are off limits and how testing runs are agreed in writing before work starts, configuration reviews work from read-only access, and testing uses accounts created for the engagement rather than production credentials or real customer data. The work runs under a non-disclosure agreement that does not lapse when the invoice is paid. Retention, return and deletion of engagement evidence are set in the engagement contract, so agree them there.
About this help article
Written by SecureRoot Risk Advisory LLP.
Before work starts
What is agreed in writing first
For testing, SecureRoot agrees the targets, test accounts, roles and any off-limits actions and data with you, then sets testing windows and escalation contacts. That becomes a signed Rules of Engagement before any testing begins. Where production is the only realistic target, destructive actions stay off the table and the accounts and records the testers may touch are agreed in advance.
Use the same moment to agree the evidence questions the contract should answer: how files are exchanged, who on each side may receive them, how long each party keeps them, and what happens to them at the end.
Access
Give the least access that does the job
- Testing: fresh test accounts per role, in an environment holding seeded data. SecureRoot never needs your existing production credentials, a real customer's login or real customer data. The test accounts guide covers handover.
- Configuration reviews: read-only roles and exported configuration. SecureRoot does not change your configuration; your team applies any fix through its own change process.
- SOC 2 readiness: if you use a compliance platform, you grant it access to your cloud, HR system and code repositories. Scope that access to what the controls need, and review it like any other vendor's.
- Give every engagement credential an expiry date and revoke it when the engagement closes. Rotate any secret that was shared, even briefly.
Sharing
Share evidence so it can be controlled
- Use one agreed channel for files, with named recipients on both sides, rather than email threads that are copied onward.
- Send credentials and the files they unlock by separate channels.
- Redact personal data from screenshots, exports and logs unless the control under review is about that data. For an access review, a list of roles and approvers usually shows the control; a full employee record does not add to it.
- Prefer a sample to a full population until the auditor or assessor asks for the population.
- Label sensitive files, such as network diagrams and findings reports, so they are not forwarded by mistake.
Findings
Treat the findings report as sensitive
A findings report is a map of where your systems were weak, and it stays sensitive after the fixes, because it shows how they were reached. Limit who receives it internally. For customers and partners, the attestation letter and the verified retest report are usually what you share; send a full report only under your own non-disclosure agreement with them.
At the end
Retention, return and deletion
SecureRoot does not publish a standard retention period or deletion procedure for engagement evidence; these terms are set in the engagement contract. Before you sign, decide what you want and ask for it in writing:
- How long working evidence, such as screenshots, request logs and exported configuration, is kept after the final report, and why.
- Whether you want files returned, deleted, or both, and a written confirmation when it is done.
- How deletion is carried out. NIST SP 800-88 is a common reference for sanitising storage media.
- Your own retention: keep the reports and retest records your auditors and customers will ask for, and delete the temporary access and copies you created for the engagement.
SecureRoot works from India and delivers testing remotely. If your law restricts transferring personal data out of your country, raise it at scoping, before any evidence is shared.
Scope boundaries
What this does not cover
- This article describes good practice and what SecureRoot publishes; your engagement contract sets the binding terms on confidentiality, retention and deletion.
- You decide what evidence to share and are responsible for redacting data you are not permitted to disclose.
- This is not legal advice on data protection or cross-border transfer law.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- OWASP Secrets Management Cheat Sheet: least privilege, expiry, rotation and revocation
OWASP Foundation · Link checked 2026-11-13
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
National Institute of Standards and Technology · Link checked 2026-11-13
Related
Services and help that go with this
- Preparing test accounts and staging
Test accounts per role, seeded data and safe credential handover.
- Preparing evidence for an ISO 27001 audit
What evidence the audit needs, as opposed to how it is shared.
- Understanding findings and retesting
What the findings and retest reports contain.
Agree the evidence terms at scoping
Tell SecureRoot on the scoping call what data your systems hold and any transfer or retention rules you work under, and we will reflect them in the written scope and Rules of Engagement.