Table of contents
- Initial Validation Round: Upload and attach evidence documents
- Second Validation Round: Upload additional evidence for any remaining unvalidated controls
Initial Validation Round: Upload and attach evidence documents
Uploading and attaching evidence documents can occur at any time throughout the questionnaire process, however it is highly recommended that you do so while answering each control. Within each critical control question and found on the Evidence Help Sheet is a list of guidance on the types of documents most likely to validate that control, and where you may be able to locate that information within your organization. Refer to this information while uploading documents to ensure the most applicable documents are provided. This file will update based on your progress through the validation process. For more information and support regarding evidence documents, refer to this article.
You will not be asked to provide evidence for controls you indicated that you have not implemented or are not applicable (i.e. control is answered 'No' or 'NA'), so you only need to provide evidence for controls answered 'Yes'. Prior to initiating a validation round, each 'Yes' answered Critical Control should have at least one attached document.
Document upload occurs on the 'Documents' tab of the Questionnaire Dashboard, by selecting the 'Upload Document' button within the Document Repository or you may do so within an individual control question itself within the 'Attachments' component. Document types accepted include: PDF, PNG, JPEG. Users retain complete control over their documents and what is added, removed or stored on the GRX platform. Read more about our uploaded evidence handling here.
Once uploaded, users can see when the document was uploaded, who it was uploaded by, view the document itself, or delete the document from being stored on the GRX platform. There are also insights into how many controls and which controls have been attached to a given document. Once a validation round has completed, the used in validation data will populate indicating which controls were validated using the given document as well as the date it was validated.
Attaching of controls to a given document occurs within the control question itself by navigating to the 'Attachments' drop-down and then 'Attach Documents'.
Once selected a drawer opens containing a list of all your uploaded documents. Select each relevant document that is associated with validating the given control. You may also upload more documents here or entirely delete a document from within this drawer. Once you have completed your attaching documents to the control, select the 'Update Attachments' button which will result in the selected documents now appearing in the 'Attachments'. At any time documents can be removed from a control within this same space.
Once you have uploaded everything for the initial round follow the Submit for Validation guide.
Second Validation Round: Upload additional evidence for any remaining unvalidated controls
Once the assessor has completed the initial validation round you will receive an email notification informing you of this so you can begin follow-up evidence collection. For the second round, you can use the same methods as the initial round to upload and attach documents for evidence.
Note: It is possible that you will successfully validate all controls in the initial round. If this occurs you will alternatively receive an email notifying you that validation is complete and results are now available (proceed to Reviewing Validation Results).
Upon re-entering the Validation Request in the Request and Shares table on the Questionnaire Dashboard, you will be automatically directed to only those 'Yes' answered critical controls that were unable to validated. Feedback from the Assessors on which controls they were unable to validate based on the documents previously uploaded will be listed in the Comments card of each control or the Evidence Help Sheet. The updated Evidence Help Sheet can be downloaded for review from within the platform. Feedback will also be available in platform via comments per control, displayed as an 'Assessor' comment. Refer to the Evidence Help Sheet and any Assessor Comments for best insights regarding what additional evidence is required in order to validate a given control.
You may also review on the 'Documents' tab of the Questionnaire Dashboard what documents you provided in the initial round were used by the assessor. By opening the drawer you can see the specific controls that each document was used to validate.
Once you have uploaded everything for the second round follow the Submit for Validation guide.