Paste the request your auditor actually sent. It splits it into individual asks, works
out which of your systems holds each one, and gives you the steps to pull it —
regrouped so you do all your AWS items in one sitting instead of ping-ponging down the
auditor's list.
The period changes the answer: a Type II request wants
evidence spanning the whole window, and that's usually what people get caught out by.
1. The auditor's request
Paste the whole thing — the email, the PBC list, the columns out of their
spreadsheet. Messy is fine; it gets split up for you.
2. What do you actually run?
This is the whole world the tool is allowed to source evidence from. If you
didn't tick it, it can't come from there — which is exactly how you find the real gaps.
About a minute. One pass to split the request, then a pass per batch of items.