The security evidence pack

Open Evidence in Strays

The 15 questions

The evidence pack answers the 15 security questions customers and insurers ask most, such as "Do you enforce MFA?", with what Strays checked and when.

• Yes: every check behind the answer ran and found nothing.
• Partly: some things still need fixing before you can answer yes. The answer lists them.
• Not checked: a check couldn't run, so Strays makes no claim.

Under the counts, one line sums it up, for example "3 of 15 answers are a clear yes. Fix the 12 Partly answers before answering yes on the form.", and what each answer means is spelt out beside it.

The counts at the top of the page are links: choose Partly, for example, to see just those answers, and choose it again (or Show all answers) to see them all.

A finding you kept or snoozed still counts: the answer stays at Partly, and the page says how many kept or snoozed findings that is. This week's Evidence card and this page use the same rule, so their numbers agree. Keeping something records a decision; it doesn't make the problem go away.

It covers AWS only, and supports (but isn't) a Cyber Essentials certification.

Other frameworks

Use Framework on the Evidence page to see the same scans against the CIS AWS Foundations Benchmark, ISO/IEC 27001:2022 Annex A or the SOC 2 Trust Services Criteria. Instead of questions, you get one entry per control that Strays has a check for:

• the control's plain title first and its number second, such as "Secure authentication (ISO 27001 A.8.5)";
• the checks behind the control: the first three, with the rest under The other N checks (the pack lists them all);
• Pass, Fail or Not checked for each AWS account, from its latest scan (a control passes only if every check behind it ran and found nothing);
• the findings to fix, and the control's overall Yes, Partly or Not checked.

The Cyber Essentials pack is on every plan. The CIS, ISO 27001 and SOC 2 packs are on the Business plan, and during the trial; on other plans the evidence page shows Cyber Essentials.

Downloading the pack or saving it as a PDF

Choose Download the pack for a dated copy you can send to a customer or insurer. It follows the framework you have chosen, and counts as one download on the Free plan; Team and above can download as often as they like. Only downloads made while you are on the Free plan count: ones you made during the trial or on a paid plan don't use it up. Members and admins can download; viewers can read the pack on screen but not download it, so a read-only person can never use up your allowance.

Choose Save as PDF when you need a PDF, for an insurer's portal for example. The same pack opens in a new tab: use your browser's Print (Ctrl+P, or Cmd+P on a Mac) and choose Save as PDF as the printer. A note at the top says how, and isn't printed. Saving as a PDF counts as a download, with the same rules: members and admins can, viewers can't, and on the Free plan it uses up the one download.

Written explanations (Business plan)

On the Business plan, Draft the written explanations asks AI (Anthropic's Claude, run by Amazon Bedrock in the EU) to write the explanation an auditor or a questionnaire asks for, for each answer or control: what was checked, in which accounts, the result, and for a Partly, what's outstanding. It's written only from the results on the page, in your voice ("We ..."), and claims no more than they show: a Not checked answer stays unclaimed, and nothing implies Strays checked your policies, people or processes. They're drafts, shown under each answer on screen and in the pack you download, where each is labelled as drafted by AI: read each one before you send the pack. After a new scan, redraft them so they match; until you do, the download leaves them out, so a pack never pairs one scan's results with another's drafts.

What is not covered

Strays covers the AWS technical controls only. Each framework's policies, people, physical and process controls are outside Strays, and the pack says so. Controls are listed by number with our own short wording, not the framework's text, and a check is mapped only where it genuinely evidences the control. A pack supports an assessment, a certification or an audit; it isn't one.