Documentation › Using Steward IT Census
Audit evidence
Audit evidence (Security › Compliance › Audit evidence) is a checklist of the security practices that auditors, customers and cyber-insurance questionnaires ask about, from device inventory to incident response. Census proves what it can from its own data and links to the page or report that shows it. For practices it can't see, you record how you handle them and attach documents. Print it or export it for the auditor.
The list and its wording are Census's own. It covers the practices most security frameworks and questionnaires have in common; when an auditor uses a specific framework, use this page as your evidence and map it to their questions.
Status of an item#
| Status | Meaning |
|---|---|
| Evidenced | Census's data shows the practice is in place, for example every checked computer passes the screen lock check |
| Attested | You confirmed that you do this, with a note and optionally documents |
| Partial | Part of it is shown, for example two-step sign-in is required on the Census console, but other administrator access isn't something Census can see |
| Gap | The data shows a problem (failing computers, software past end of life, no alert rules…) or the control isn't in use |
| Needs your input | A process Census can't see (training, incident response…), or Census has no automatic check for it on your computers' systems |
| Review due | You attested it more than a year ago: confirm it again |
| Not applicable | You marked it as not applying to your organization, with the reason |
Done at the top is the share of items that are evidenced or attested, leaving out the ones you marked as not applicable. Start with the items marked Essential; the Recommended ones go further.
An attestation never turns a gap into done: when the data shows a problem, fix it, or accept the risk on the compliance check (an accepted risk counts as passed there). Items that rely on compliance checks list those checks, colored by result; click one to see the computers and how to fix them.
Census checks the automatic items every few minutes; Check again does it right away (after a rescan, for example).
Recording your statements#
Click Attest… (or Add note… on an evidenced item, Edit… once there is a statement):
- We do this (attest) marks the item as done. Say how you handle it, for example Yearly awareness course for all staff since 2024; records kept by HR.
- Note only keeps a note without marking the item done.
- Doesn't apply to us leaves the item out of the score. A reason is required.
- Documents: attach policies, training records, test results or screenshots (up to 20 per item, 50 MB each). They are included in Census's backups.
Each statement shows who made it and when. Logins with the Compliance permission can see the page and record statements; roles limited to some assets don't see it, because it describes the whole organization.
For the auditor#
- Print / PDF prints the page without the menus (choose Save as PDF in the print dialog).
- Export (CSV) gives one row per item: area, item, level, status, evidence, your note, who attested it and when, and the document names.
- PDF for auditors is the same checklist as a document: the score, then each area with its items, the evidence, attestations and document names, coloured by status, with your company name, the date and page numbers. Hand it to an auditor or attach it to an audit file.
- The Audit evidence dashboard widget shows the share done and the open gaps.
The items#
Devices#
| Item | Level | Evidence |
|---|---|---|
| Up-to-date device inventory: Every computer, server and network device is recorded with its owner, location and hardware details, and the list is refreshed automatically. | Essential | Active assets and recent inventories |
| Regular network discovery: The network is scanned on a schedule so new devices are found, not only the ones someone remembers to add. | Essential | Scheduled scan targets that ran recently, online Census agents |
| New devices are noticed between scans: Devices that join the network are spotted soon after they appear, for example from DHCP and ARP traffic. | Recommended | Passive discovery turned on |
| Unknown devices are dealt with: Devices found on the network that nobody can identify or manage are looked into, then managed, documented or removed. | Essential | Never inventoried report |
| Stale records are cleaned up: Devices that are no longer seen are retired or explained, so the inventory matches reality. | Recommended | Not seen for 30 days report |
Software#
| Item | Level | Evidence |
|---|---|---|
| Software inventory: Installed programs and their versions are recorded for every computer and server. | Essential | Assets with installed software |
| Only approved software: Installed software is reviewed; anything not approved is removed or explicitly tolerated. | Essential | Unauthorized and not-yet-reviewed software |
| Software is still supported: Programs that no longer get security updates from their vendor are replaced or upgraded. | Essential | End of life of installed programs |
| Application allowlisting: Only approved programs and scripts can run on computers (for example AppLocker or Windows Defender Application Control). | Recommended | Your statement |
Secure configuration#
| Item | Level | Evidence |
|---|---|---|
| Secure configuration standard: Computers and servers follow a documented hardening standard and are checked against it. | Essential | Average compliance score (80% or more) |
| Screens lock when unattended: Computers lock automatically after a short period of inactivity. | Essential | Compliance check: screen lock |
| Host firewalls are on: The built-in firewall is on for every network profile on computers and servers. | Essential | Compliance checks: Windows, Linux and macOS firewall |
| No automatic running from removable media: Programs on USB drives and discs don't start by themselves when they're plugged in. | Essential | Compliance checks: AutoRun and AutoPlay |
| Default and guest accounts are disabled: Guest accounts and automatic sign-in are off. | Essential | Compliance checks: guest accounts, automatic logon |
| Remote management is secured: Remote management uses encrypted, authenticated protocols; old protocols such as SMBv1, Telnet and rsh are off. | Essential | Compliance checks: SMBv1, WinRM, Remote Desktop, SSH, Telnet, rsh |
| Network devices are hardened: Switches, firewalls, Wi-Fi and printers have default passwords changed, unused services off and current firmware. | Recommended | Inventoried network devices, plus your statement |
Accounts and privileges#
| Item | Level | Evidence |
|---|---|---|
| Account inventory: All user and administrator accounts are known, kept in a central directory and reviewed. | Essential | Active Directory or Entra ID synchronized in the last 7 days |
| Dormant accounts are disabled: Accounts that haven't been used for a long time are disabled or removed. | Essential | Stale directory accounts (your statement without a directory) |
| Administrator rights are limited: Only approved people have administrator rights, and the list of administrators is checked. | Essential | Authorized administrators list and the Unauthorized administrators report |
| Strong passwords: Password rules require long passwords, and no account has an empty password. | Essential | Compliance checks: password length and complexity, blank passwords |
| Unique local administrator passwords: Each computer's local administrator account has its own password that changes regularly (for example with LAPS). | Essential | Compliance check: LAPS |
| Password guessing is stopped: Accounts lock for a while after repeated wrong passwords. | Recommended | Compliance checks: account lockout |
| Joiners and leavers process: Access is granted, changed and removed through a defined process when people join, move or leave. | Essential | Your statement |
| Service accounts are documented: Accounts used by programs and services are listed with their owner and purpose, and reviewed. | Recommended | Your statement |
Sign-in#
| Item | Level | Evidence |
|---|---|---|
| Two-step sign-in for administrators: Administrators sign in with a second factor (authenticator app, security key) to management consoles and admin accounts. | Essential | Two-step sign-in required on the Census console, plus your statement |
| Two-step sign-in for remote and online access: VPN, remote desktop gateways, email and other services reachable from the internet require a second factor. | Essential | Your statement |
| Stored sign-in secrets are protected: Computers don't keep passwords in readable form and use modern authentication only. | Recommended | Compliance checks: WDigest, LSA protection, NTLMv2, LM hashes |
Vulnerabilities and updates#
| Item | Level | Evidence |
|---|---|---|
| Automatic vulnerability scanning: Computers and servers are checked for known vulnerabilities at least monthly. | Essential | Assets assessed for vulnerabilities |
| Operating system updates: Operating system security updates are installed automatically and promptly. | Essential | Missing Windows updates and automatic-update checks |
| Application updates: Browsers, PDF readers and other third-party programs are kept up to date. | Essential | Vulnerable third-party applications |
| Serious vulnerabilities are fixed quickly: Vulnerabilities that are exploited in the wild or rated critical are fixed or mitigated within a set time. | Essential | Exploited and critical vulnerabilities open |
| Supported operating systems: Every computer, server and network device runs a system version that still gets security updates. | Essential | End of life of operating systems |
| Documented remediation process: A written process says who fixes vulnerabilities, how fast for each severity, and how exceptions are approved. | Recommended | Your statement |
Malware protection#
| Item | Level | Evidence |
|---|---|---|
| Anti-malware on every computer: Anti-malware software runs on computers and servers and updates its signatures automatically. | Essential | Antivirus report and compliance check |
| Download and website protection: Downloads and websites are checked for known malware and phishing before they open. | Recommended | Compliance check: SmartScreen |
| Exploit protection: Operating system protections against exploits and boot-level malware are on. | Recommended | Compliance checks: Secure Boot, SEHOP, ASLR, SIP, Gatekeeper |
Data protection and recovery#
| Item | Level | Evidence |
|---|---|---|
| Disk encryption on laptops and desktops: Disks of end-user computers are encrypted, so a lost or stolen device doesn't expose data. | Essential | Compliance checks: BitLocker, FileVault |
| Encryption in transit: Services use valid certificates with strong keys; expired or weak certificates are replaced. | Recommended | Expired and weak certificates |
| Automatic backups: Important data and systems are backed up automatically, with a copy kept offline or isolated from the network. | Essential | Your statement (Census backs up only its own data) |
| Restores are tested: Restoring from backup is tested regularly, and the result is recorded. | Essential | Your statement |
| File integrity monitoring: Changes to important system files are detected, for example with AIDE on Linux servers. | Recommended | Compliance check: file integrity tool installed |
| Sensitive data is known: You know where sensitive data is stored, who can access it, and how long it's kept. | Recommended | Your statement |
Logging and monitoring#
| Item | Level | Evidence |
|---|---|---|
| Security events are logged: Computers and servers record sign-ins, account changes and other security events. | Essential | Compliance checks: audit policy, auditd |
| Clocks are synchronized: All systems take their time from a reliable source, so logs line up. | Essential | Compliance checks: time synchronization |
| Logs are collected centrally: Event logs from computers and servers are gathered in one place. | Recommended | Event log collection turned on |
| Events reach your security monitoring: Security-relevant events are forwarded to a SIEM or monitoring service where someone sees them. | Recommended | An integration forwarding events |
| Logs are kept long enough: Logs are kept for at least 90 days so incidents can be investigated. | Recommended | Event logs kept for 90 days or more |
| Alerts and log reviews: Important events raise alerts, and logs are reviewed on a schedule. | Essential | Alert rules turned on, plus your statement |
Network#
| Item | Level | Evidence |
|---|---|---|
| Network diagram: An up-to-date diagram shows how switches, routers and sites connect. | Recommended | Switches and routers on the network map |
| Network segmentation: Servers, user computers, guests and devices such as cameras are on separate networks with rules between them. | Recommended | Your statement |
| Secure remote access: Remote access to the internal network goes through a VPN or gateway with two-step sign-in; nothing else is exposed. | Essential | Your statement |
People and processes#
| Item | Level | Evidence |
|---|---|---|
| Written security policy: A short written policy says how IT is protected and who is responsible, and it's reviewed every year. | Essential | Your statement |
| Security awareness training: Everyone gets security awareness training (phishing, passwords, reporting) when they start and every year. | Essential | Your statement |
| Incident response plan: There is a plan for security incidents: who to call, what to do first, and how to report it. | Essential | Your statement |
| Service providers are managed: Providers with access to your systems or data are listed, and their security is checked. | Recommended | Your statement |
| Security testing: Defenses are tested regularly, for example with a penetration test or a phishing exercise. | Recommended | Your statement |