Evidence Management

Every PCI DSS assessment depends on evidence — firewall configurations, policy documents, access control screenshots, scan reports, and more. Kliper provides a structured evidence management pipeline that handles file uploads, malware scanning, integrity hashing, AI-powered validation, and document tagging in a single workflow.

Uploading Evidence Files

Evidence files are uploaded through the Attachments Panel on the right side of the Assessment Workbench.

Accepted File Types

Executables, scripts, and other potentially dangerous file types are blocked at upload. See Security & AI Trust for the full blocklist.

Scanned PDFs

A PDF holds text in one of two ways. Most are text-based: the words are stored as text and can be read directly. A scanned PDF is a photograph of a page — to a computer it is an image, with no text inside it at all.

Kliper detects which kind it has. When a PDF has no text layer, it says so, rather than reporting a successful upload with an empty analysis. This matters for evidence such as a signed policy that was printed, signed, and scanned back in: there is genuinely nothing for Cortex to read, and knowing that is more useful than a blank summary you have to work out for yourself.

If you hit this, run the file through OCR — most scanners and PDF tools offer “make searchable” or “recognise text” — and upload the result. Kliper does not perform OCR itself.

The Attachments Table

Each uploaded file appears as a row in the attachments table with the following columns:

Each file also records who provided it — the person who uploaded it in the app, or the client contact who submitted it through the portal. The row shows the provider, not the surface the file happened to arrive on, so “who gave us this” is answerable at a glance and carries through to the full-page evidence view.

Malware Scan Status

Every file displays a scan status badge immediately after processing:

Each file is checked by ClamAV (local antivirus) and a VirusTotal hash lookup (70+ antivirus engines) during processing.

Evidence Validation Status

Each file has a validation status dropdown that tracks the assessor’s review progress:

Select the appropriate status from the dropdown to update the file’s review state. Changes persist immediately.

Document Tags (Doctags)

Doctags are standardized reference codes that categorize evidence files by their purpose in the PCI DSS assessment. They map files to specific documentation requirements in the ROC template (e.g., DOCFW for firewall documentation, PENTEST for penetration test reports).

How Doctags Are Assigned

Doctags can be assigned in two ways:

AI-Suggested Tags:

After Cortex AI analyzes a file, it suggests relevant doctags with confidence scores. In the file’s expanded detail row:

• Suggested tags appear as outline badges with a confidence percentage (e.g., DOCFW 92%)
• Click the + button on a suggested tag to assign it
• Assigned tags appear as solid blue badges with an x to remove

Manual Assignment:

In the file’s detail panel, you can manually search for and assign doctags that Cortex did not suggest.

Common Doctags

Over 100 doctags are available, covering every documentation category defined in the PCI DSS v4.0.1 ROC template.

Automatic Section 6.4 Sync

When a doctag is assigned to a file, the platform automatically updates the Section 6.4 Documentation Evidence table in your assessment. Each tagged file creates or updates a row with:

• Reference — the assigned doctag(s) (e.g., DOCFW, DOCHARD)
• Document Name — the file name
• Purpose — AI-generated description of the file’s content
• Revision Date — the upload date

This sync happens transparently. Manual rows you enter directly in Section 6.4 are preserved alongside auto-generated rows.

Evidence Coverage

The Evidence tab of an assessment has two views — Files (the attachments table) and Coverage, a traceability lens over the control → tag → artifact chain.

How the Chain Works

1. In a testing-procedure response, cite the evidence tag you relied on (type / to open the tag menu — e.g. DOCFW for firewall documentation).
2. Section 6.4 resolves each tag to the actual artifacts that were provided.
3. Coverage cross-references the two and tells you where the chain holds and where it breaks.

By Control

Every control with a finding is classified:

Controls are grouped by requirement (collapsed by default) with summary chips to filter — No proof and Dangling are the review-day lists. Each row deep-links into the requirement editor.

By Tag

The inverse lens: every cited tag with how many controls cite it and how many Section 6.4 artifacts back it. Dangling tags sort first. A registered-but-never-cited tag shows as Unused — evidence someone collected that no response leans on.

Matrix

A controls-by-tags citation grid: rows are controls, columns are cited tags, cells mark where a citation is backed or dangling. Tag headers are hoverable for definitions, and a Cited rows only toggle hides controls with no citations.

Cortex AI Analysis

After upload, Cortex AI automatically analyzes each file and provides:

Requirement Matching

Cortex identifies which PCI DSS requirements the file is relevant to. In the expanded file detail row:

• Each suggested requirement shows the requirement number, title, and a confidence score
• Confidence is color-coded: green (80%+), amber (50–79%), gray (below 50%)
• Click Link to associate the file with a requirement, or Unlink to remove the association

Criteria Validation

If a validation specification exists for the linked requirement, Cortex checks the file against the specific content criteria that the ROC template requires:

Expand the validation result to see a per-criterion checklist:

• Checkmark — criterion found, with a brief excerpt from the document
• X mark — criterion not found, with a note explaining what is missing

AI Summary

Each analyzed file receives:

• Relevance — why this file matters for compliance
• Summary — AI-generated description of the file’s contents
• Document Type — classification badge (e.g., PDF, spreadsheet, configuration)
• Model — which AI model performed the analysis

Analyse Without Retaining

Some clients will not let their documents rest on a third-party platform — a common condition when the evidence contains network diagrams, key-management procedures, or personal data. For those engagements, Kliper can read a file once for analysis and never store it.

The setting is per client, so one client’s documents can be handled this way while the rest of your book of business works normally.

What changes

In the attachments table, files handled this way are labelled Analysed, not stored, and the download action is unavailable.

Every analysed-not-stored upload is recorded in the audit trail, so the engagement file shows what was examined even though the document itself was not kept.

File Integrity Verification

Every file is SHA-256 hashed at the moment of upload. At any time after upload, you can verify that the file has not been altered in storage.

File Metadata Preview

Kliper automatically extracts metadata from uploaded files, giving assessors immediate context without downloading:

This metadata appears in the file’s expanded detail row and helps assessors identify files without opening them.

View Modes and Filtering

The Attachments Panel supports multiple view modes:

Toggle between modes using the view buttons at the top of the Attachments Panel.

Bulk Operations

Select multiple files using the checkboxes to perform bulk actions:

• Download Selected — downloads all selected files
• Delete Selected — removes all selected files from the assessment

Selection resets automatically when you switch between requirements or view modes.

Evidence Requests by Assessment

When working across multiple assessments, the Evidence Requests panel groups requests into collapsible sections — one per assessment. This lets you focus on one engagement at a time without losing sight of the others.

Each section header displays:

• Assessment name
• Total request count — all requests in that assessment
• Accepted badge — number of requests in accepted status
• Open badge — number of requests still pending or in progress

Click the section header to collapse or expand it. All sections are expanded by default. Badge counts update immediately when a request status changes.

Reviewing submitted evidence

When a client uploads evidence against a request, you review it and record a decision. Open the request and choose one of three actions — each shows the consequence before you confirm, writes to the audit log, and (where relevant) notifies the client:

The expanded request row shows a per-status footer — e.g. Review evidence when something’s awaiting review, Re-review on an already-accepted or waived request, and Nudge client while a request is still open.

Nudge a client

While a request is still open (nothing submitted yet), click Nudge client to email a reminder — the request title, due date, and a portal sign-in link — to every invited (non-revoked) client on the assessment.

Evidence Request Templates

Kliper includes 56 pre-built PCI DSS evidence request templates covering all 12 principal requirements. Templates let assessors create evidence requests in seconds instead of filling forms from scratch.

Using Templates

Template Coverage

Downloading and Deleting Files

Download

Click the Download button in the actions column for any file. The file downloads with its original filename. For bulk downloads, select multiple files and click Download Selected.

Delete

Click the Delete button in the actions column. The file is removed from the assessment immediately. If the file was linked to a requirement section, the link is automatically cleared.