Looking for other folks who have been tasked with collecting and organizing evidence that comply with the controls. If you are familiar, let me hear your stories, success or otherwise. I know there are companies that specializing in the audit aspect of this requirement but would like to hear from people (like us writers, analysts, etc.) who have done heavy lifting for a project such as this. Respond in thread or directly to me.