Book a walkthrough
Compliance evidence

Can you prove the technology behind your critical services is compliant?

Answer auditors, insurers, customers and the board with evidence drawn from your estate, on a schedule, instead of screenshots and spreadsheets.
Book a 30-minute walkthrough See Cyber Essentials
Governance

Collected evidence is stronger than gathered evidence

Manually gathered evidence ages from the day it is assembled and shows only what someone remembered to capture. Rebasoft draws evidence from the estate itself, which cuts preparation time and gives your team confident answers about the services the business relies on.

Scope you can defend

Where a spreadsheet goes stale, in-scope lists come from asset discovery and reflect what is on the network.

Results without manual entry

Configuration, identity, patching and end-of-life data feed the Cyber Essentials verdict directly, which removes the screenshot round.

Coverage auditors can trust

Because Rebasoft runs the collection, it names the devices it could not reach, so a gap never passes as assurance.

Evidence you can rely on

Green means checked

False assurance is the real audit risk. A control passes when its evidence is complete and current. Otherwise Rebasoft reports Not assessed and gives the reason, so your team resolves the gap before an auditor finds it.

Patching412 of 412 devices checked
Pass
Malware protection3 devices with no protection
Fail
Secure configuration38 devices unreachable: credential rejected
Not assessed
Illustrative example
A quarter on one site

A verdict that stands up in the audit

  1. Monday

    A site reports clean results

    SSH collection has failed on part of a site, although every check that did run came back clean. A dashboard that counts only what it reached would show this control as green.

  2. Monday

    The control is held at Not assessed

    Rebasoft shows the control as Not assessed and gives the coverage percentage as the reason. The overall verdict is held at the same status.

  3. Tuesday

    The collection issue is resolved

    An engineer restores SSH access. The next collection covers the site, and the control passes on evidence.

  4. Weeks later

    SMBv1 reappears on a server

    A Group Policy change reverses an earlier fix. The next collection reads the setting by PowerShell, without an agent, and reopens the finding with its history intact.

  5. Audit

    The evidence is already in place

    When the auditor asks how drift is managed, the team presents the finding’s history and the scheduled report, complete with its coverage statement.

A composite example based on product behaviour.

Cyber Essentials

Cyber Essentials is built in

Rebasoft replaces the blank form with a live verdict and a pre-filled submission workbook. Cyber Essentials is also the natural first step towards ISO 27001 and NIST CSF, so the same evidence gives those programmes a head start. See how it works.

Verdict
A live status

Firewalls, secure configuration, user access, malware protection and patching on a single screen.

Workbook
The full IASME question set

Around half of the questionnaire arrives pre-filled from collected data, with evidence sheets and a coverage badge on each row.

Checks
The controls behind it

Identity rules, host checks and TLS rules.

Reports

Evidence packs arrive on schedule, ready for the auditor

Scheduled by site

Configure a report once for each site and it arrives by email, so evidence for the sites your services run on never needs chasing.

Ready for each audience

PDF for the board, XLSX for working files and a data pack for the auditor, with no reformatting.

A coverage statement built in

Every report states what was covered, and a template cannot remove it. Auditors gain confidence in what they are reading.

Consolidation

Less manual evidence, a stronger compliance programme

Rebasoft removes the manual work behind your evidence and strengthens the programme you already run.

Manual Cyber Essentials evidence packs
Can replace
Scheduled reports from collected data end the screenshot round before each audit.
Evidence held on shared drives
Can replace
Answers with history, and supporting documents attached to each Cyber Essentials question, so nothing has to be found again next year.
Cyber Essentials preparation consultancy
Consolidates
The technical groundwork arrives ready, which focuses paid advice on scope and policy.
Compliance platforms
Consolidates
Keep your platform and feed it Rebasoft reports, or consolidate where Cyber Essentials is the requirement.
FAQ
We already use a compliance platform. What does this add?
A compliance platform sees what its integrations reach. Rebasoft adds scope from discovery and a clear statement of coverage, in reports you export and upload, so your programme rests on evidence from the estate itself.
How do auditors know the evidence is sound?
Every report carries a coverage statement that a template cannot remove, setting out what the collection could and could not vouch for. Auditors see the basis of each result, which shortens the conversation. Certification stays with your certification body.

More questions? See the full Rebasoft FAQ — answers by topic and by role, or how Rebasoft is priced.

Further reading

From the blog

All cyber essentials & compliance articles →See it in practice: international charity →
Top MSP Compliance Services for Real Assurance
Cyber Essentials & compliance 19 Oct 2026

Top MSP Compliance Services for Real Assurance

Top MSP compliance services should deliver continuous evidence, clearer priorities and audit-ready reporting - without adding operational overhead at all.

Read article
What Is Continuous Compliance Monitoring?
Cyber Essentials & compliance 5 Oct 2026

What Is Continuous Compliance Monitoring?

What is continuous compliance monitoring? See how control evidence, risk prioritisation and service context reduce audit effort and strengthen assurance.

Read article
Audit Evidence Automation That Stands Up to Scrutiny
Cyber Essentials & compliance 1 Oct 2026

Audit Evidence Automation That Stands Up to Scrutiny

Audit evidence automation replaces last-minute evidence hunts with continuous, traceable proof of control performance, risk and business impact clearly.

Read article

See the evidence behind your critical services

In thirty minutes, see a live verdict and a coverage statement, and how much audit preparation they could remove from your year.

Book a 30-minute walkthrough How deployment works