Evidence Management

Every PCI DSS assessment depends on evidence — firewall configurations, policy documents, access control screenshots, scan reports, and more. Kliper provides a structured evidence management pipeline that handles file uploads, malware scanning, integrity hashing, AI-powered validation, and document tagging in a single workflow.

​

Uploading Evidence Files

Evidence files are uploaded through the Attachments Panel on the right side of the Assessment Workbench.

​

Accepted File Types

Executables, scripts, and other potentially dangerous file types are blocked at upload. See Security & AI Trust for the full blocklist.

---

​

The Attachments Table

Each uploaded file appears as a row in the attachments table with the following columns:

​

Malware Scan Status

Every file displays a scan status badge immediately after processing: Hover over the scan badge to see a tooltip with per-engine results:

• ClamAV — local antivirus scan result
• VirusTotal — hash lookup result across 70+ antivirus engines with detection count
• Scanned at — timestamp of the last scan

​

Evidence Validation Status

Each file has a validation status dropdown that tracks the assessor’s review progress: Select the appropriate status from the dropdown to update the file’s review state. Changes persist immediately.

---

​

Document Tags (Doctags)

Doctags are standardized reference codes that categorize evidence files by their purpose in the PCI DSS assessment. They map files to specific documentation requirements in the ROC template (e.g., DOCFW for firewall documentation, PENTEST for penetration test reports).

​

How Doctags Are Assigned

Doctags can be assigned in two ways: AI-Suggested Tags: After Cortex AI analyzes a file, it suggests relevant doctags with confidence scores. In the file’s expanded detail row:

• Suggested tags appear as outline badges with a confidence percentage (e.g., DOCFW 92%)
• Click the + button on a suggested tag to assign it
• Assigned tags appear as solid blue badges with an x to remove

Manual Assignment: In the file’s detail panel, you can manually search for and assign doctags that Cortex did not suggest.

​

Common Doctags

Over 100 doctags are available, covering every documentation category defined in the PCI DSS v4.0.1 ROC template.

​

Automatic Section 6.4 Sync

When a doctag is assigned to a file, the platform automatically updates the Section 6.4 Documentation Evidence table in your assessment. Each tagged file creates or updates a row with:

• Reference — the assigned doctag(s) (e.g., DOCFW, DOCHARD)
• Document Name — the file name
• Purpose — AI-generated description of the file’s content
• Revision Date — the upload date

This sync happens transparently. Manual rows you enter directly in Section 6.4 are preserved alongside auto-generated rows.

---

​

Cortex AI Analysis

After upload, Cortex AI automatically analyzes each file and provides:

​

Requirement Matching

Cortex identifies which PCI DSS requirements the file is relevant to. In the expanded file detail row:

• Each suggested requirement shows the requirement number, title, and a confidence score
• Confidence is color-coded: green (80%+), amber (50–79%), gray (below 50%)
• Click Link to associate the file with a requirement, or Unlink to remove the association

​

Criteria Validation

If a validation specification exists for the linked requirement, Cortex checks the file against the specific content criteria that the ROC template requires: Expand the validation result to see a per-criterion checklist:

• Checkmark — criterion found, with a brief excerpt from the document
• X mark — criterion not found, with a note explaining what is missing

​

AI Summary

Each analyzed file receives:

• Relevance — why this file matters for compliance
• Summary — AI-generated description of the file’s contents
• Document Type — classification badge (e.g., PDF, spreadsheet, configuration)
• Model — which AI model performed the analysis

---

​

File Integrity Verification

Every file is SHA-256 hashed at the moment of upload. At any time after upload, you can verify that the file has not been altered in storage.

---

​

File Metadata Preview

Kliper automatically extracts metadata from uploaded files, giving assessors immediate context without downloading: This metadata appears in the file’s expanded detail row and helps assessors identify files without opening them.

---

​

View Modes and Filtering

The Attachments Panel supports multiple view modes: Toggle between modes using the view buttons at the top of the Attachments Panel.

​

Bulk Operations

Select multiple files using the checkboxes to perform bulk actions:

• Download Selected — downloads all selected files
• Delete Selected — removes all selected files from the assessment

Selection resets automatically when you switch between requirements or view modes.

---

​

Evidence Requests by Assessment

When working across multiple assessments, the Evidence Requests panel groups requests into collapsible sections — one per assessment. This lets you focus on one engagement at a time without losing sight of the others. Each section header displays:

• Assessment name
• Total request count — all requests in that assessment
• Accepted badge — number of requests in accepted status
• Open badge — number of requests still pending or in progress

Click the section header to collapse or expand it. All sections are expanded by default. Badge counts update immediately when a request status changes.

---

​

Evidence Request Templates

Kliper includes 56 pre-built PCI DSS evidence request templates covering all 12 principal requirements. Templates let assessors create evidence requests in seconds instead of filling forms from scratch.

​

Using Templates

​

Template Coverage

---

​

Downloading and Deleting Files

​

Download

Click the Download button in the actions column for any file. The file downloads with its original filename. For bulk downloads, select multiple files and click Download Selected.

​

Delete

Click the Delete button in the actions column. The file is removed from the assessment immediately. If the file was linked to a requirement section, the link is automatically cleared.