Audit & compliance

#Audit events

Audit events capture actor, tenant, action, target, outcome, time, request context and relevant change metadata. Sensitive values and credentials are redacted before persistence.

#Evidence lifecycle

1. 1
   Collect

   Ingest signed attestations, configuration state and operational evidence.

2. 2
   Preserve

   Apply retention, integrity controls and legal holds.

3. 3
   Map

   Associate evidence with controls and regulatory requirements.

4. 4
   Export

   Create a bounded, auditable evidence package for reviewers.

#Framework alignment

• NCA Essential Cybersecurity Controls
• SAMA Cyber Security Framework where applicable
• Saudi PDPL data governance obligations
• ISO 27001 and SOC 2 control mappings for customer assurance