Export for auditors

Build the evidence pack or the auditor pack for one campaign, mapped to the frameworks you choose, with a content hash your auditor can check.

Two exports sit next to Results on every campaign page. Evidence pack is the document for your board. Export for auditors is the same records in the order an auditor or insurer expects, mapped to the frameworks you tick, with a content hash. Both open as a web page you print to PDF.

Both packs say so on their first page: they are evidence that supports a control. They are not proof of compliance with any law, standard or policy.

​

Before you start

• A campaign with results. See Read your results.
• Pop-ups allowed for the console in your browser. The pack opens in a new tab.
• A decision on names. Packs show teams unless Show names in reports is on. See Fair testing rules.

​

Steps

1. Open the export panel

   On the campaign page, scroll to Results and click Export for auditors. A small panel opens.

2. Tick the frameworks

   Under Frameworks to map to, tick the ones your reader will ask about. The frameworks chosen in your workspace settings are ticked already.

   Tick box	Who usually asks for it
   NIS2	EU essential and important entities, and their regulators
   DORA	EU financial entities and their supervisors
   ISO 27001:2022	Certification auditors and customers who ask for the certificate
   PCI DSS 4.0	Qualified security assessors and acquiring banks
   Cyber Essentials	UK customers, public sector buyers and insurers
   Cyber insurance	Underwriters and brokers
   Jersey (JFSC)	The Jersey Financial Services Commission and the Jersey Cyber Security Centre

3. Choose the format

   Under Format, choose HTML or PDF (print). Both are the same page. PDF (print) also opens your browser’s print dialog as soon as the page loads, so you can save it as a PDF. No PDF is generated on our side.

4. Set the planned retest

   Pick a date under Planned retest and click Save. The date goes into section 6 of the pack and onto the campaign.

5. Export

   Click Export. The pack opens in a new tab. The console confirms with Pack exported. Content hash … recorded.

​

What the auditor pack contains

Section	Title	What is in it
1	Scope and dates	Who authorised the test, the reference, the dates, the people in scope.
2	Method	How the calls were made, the attack level, the voice and its consent.
3	Who was tested	The people or teams called.
4	Results	Each person’s verdict, the detector’s verdict, and the summary.
5	Teaching delivered	What each coached person heard. See Coaching at the end of a failed call.
6	Fixes and planned retest	The recommendations and the retest date.

After the sections comes the mapping table. Each line names the control (for example Article 21(2)(g) for NIS2), what it asks for in its own words, how this test is evidence for it, and which section of the pack answers it. Some lines are notes rather than controls, such as the line explaining that Cyber Essentials does not test staff.

The last line of the pack reads Content hash (SHA-256): followed by the hash. The pack also records Exported by (account). To check a file was not altered: remove the one line that begins with Content hash (SHA-256):, hash the rest of the file with SHA-256, and compare. DeepBlocker keeps a record of every auditor pack export with its hash, the frameworks, the format, who exported it and when.

​

What the evidence pack contains

Evidence pack opens the board document straight away, with no panel. Its sections are Executive summary, Attack and defence on the same calls, Engagement authorization, Voice consent, MITRE ATT&CK techniques exercised, Regulatory & framework mapping, Per-employee results and Recommended fixes. A help desk test shows Per-call results instead, and a call-back trap shows Inbound calls, including the people who were messaged and never called.

​

Names in the packs

Both packs follow the same rule as the results table. People appear by team unless Show names in reports is on in your fair testing settings, or you clicked Show names on the campaign page before exporting. Only owners, admins and the person who created the campaign can click Show names.

​

Problems

Nothing opened, and the console says Allow pop-ups to open the pack

Your browser blocked the new tab. Allow pop-ups for the console, then click Export again.

It says Could not build the compliance pack

Try again in a minute. If it keeps failing, write to [e-mail] with the campaign name.

The mapping has a line that says Nothing here to meet

That line is a note for the reader, not a control. For example, Cyber Essentials covers five technical controls and does not test staff, so the pack explains why it is still asked for.

My auditor wants a signed PDF from DeepBlocker

The pack is self-contained and carries a content hash, which is what we offer. Save it as a PDF from your browser. For anything more, write to [e-mail].