> ## Documentation Index > Fetch the complete documentation index at: https://docs.deepblocker.ai/llms.txt > Use this file to discover all available pages before exploring further. # Export for auditors > Build the evidence pack or the auditor pack for one campaign, mapped to the frameworks you choose, with a content hash your auditor can check. Two exports sit next to **Results** on every campaign page. **Evidence pack** is the document for your board. **Export for auditors** is the same records in the order an auditor or insurer expects, mapped to the frameworks you tick, with a content hash. Both open as a web page you print to PDF. > [!NOTE] > > Both packs say so on their first page: they are evidence that supports a control. They are not proof of compliance with any law, standard or policy. ## Before you start * A campaign with results. See [Read your results](https://docs.deepblocker.ai/vishing/results/overview.md). * Pop-ups allowed for the console in your browser. The pack opens in a new tab. * A decision on names. Packs show teams unless **Show names in reports** is on. See [Fair testing rules](https://docs.deepblocker.ai/vishing/fair-testing.md). ## Steps **1. Open the export panel** On the campaign page, scroll to **Results** and click **Export for auditors**. A small panel opens. **2. Tick the frameworks** Under **Frameworks to map to**, tick the ones your reader will ask about. The frameworks chosen in your workspace settings are ticked already. | Tick box | Who usually asks for it | | - | - | | **NIS2** | EU essential and important entities, and their regulators | | **DORA** | EU financial entities and their supervisors | | **ISO 27001:2022** | Certification auditors and customers who ask for the certificate | | **PCI DSS 4.0** | Qualified security assessors and acquiring banks | | **Cyber Essentials** | UK customers, public sector buyers and insurers | | **Cyber insurance** | Underwriters and brokers | | **Jersey (JFSC)** | The Jersey Financial Services Commission and the Jersey Cyber Security Centre | **3. Choose the format** Under **Format**, choose **HTML** or **PDF (print)**. Both are the same page. **PDF (print)** also opens your browser's print dialog as soon as the page loads, so you can save it as a PDF. No PDF is generated on our side. **4. Set the planned retest** Pick a date under **Planned retest** and click **Save**. The date goes into section 6 of the pack and onto the campaign. **5. Export** Click **Export**. The pack opens in a new tab. The console confirms with **Pack exported. Content hash ... recorded.** ## What the auditor pack contains | Section | Title | What is in it | | - | - | - | | 1 | **Scope and dates** | Who authorised the test, the reference, the dates, the people in scope. | | 2 | **Method** | How the calls were made, the attack level, the voice and its consent. | | 3 | **Who was tested** | The people or teams called. | | 4 | **Results** | Each person's verdict, the detector's verdict, and the summary. | | 5 | **Teaching delivered** | What each coached person heard. See [Coaching at the end of a failed call](https://docs.deepblocker.ai/vishing/results/coaching.md). | | 6 | **Fixes and planned retest** | The recommendations and the retest date. | After the sections comes the mapping table. Each line names the control (for example **Article 21(2)(g)** for NIS2), what it asks for in its own words, how this test is evidence for it, and which section of the pack answers it. Some lines are notes rather than controls, such as the line explaining that Cyber Essentials does not test staff. The last line of the pack reads **Content hash (SHA-256):** followed by the hash. The pack also records **Exported by (account)**. To check a file was not altered: remove the one line that begins with **Content hash (SHA-256):**, hash the rest of the file with SHA-256, and compare. DeepBlocker keeps a record of every auditor pack export with its hash, the frameworks, the format, who exported it and when. ## What the evidence pack contains **Evidence pack** opens the board document straight away, with no panel. Its sections are **Executive summary**, **Attack and defence on the same calls**, **Engagement authorization**, **Voice consent**, **MITRE ATT\&CK techniques exercised**, **Regulatory & framework mapping**, **Per-employee results** and **Recommended fixes**. A help desk test shows **Per-call results** instead, and a call-back trap shows **Inbound calls**, including the people who were messaged and never called. ## Names in the packs Both packs follow the same rule as the results table. People appear by team unless **Show names in reports** is on in your fair testing settings, or you clicked **Show names** on the campaign page before exporting. Only owners, admins and the person who created the campaign can click **Show names**. ## Problems > [accordion] Nothing opened, and the console says Allow pop-ups to open the pack > > Your browser blocked the new tab. Allow pop-ups for the console, then click **Export** again. > [accordion] It says Could not build the compliance pack > > Try again in a minute. If it keeps failing, write to [contact@deepblocker.ai](mailto:contact@deepblocker.ai) with the campaign name. > [accordion] The mapping has a line that says Nothing here to meet > > That line is a note for the reader, not a control. For example, Cyber Essentials covers five technical controls and does not test staff, so the pack explains why it is still asked for. > [accordion] My auditor wants a signed PDF from DeepBlocker > > The pack is self-contained and carries a content hash, which is what we offer. Save it as a PDF from your browser. For anything more, write to [contact@deepblocker.ai](mailto:contact@deepblocker.ai). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.