Set Up Evidence Management for IT Compliance

Manage User Access

Assign permission sets to auditors and admins who configure the system, compliance fulfillers who handle requests internally, and employee fulfillers who provide evidence from the IT Service employee portal.

1. On the Evidence Management for IT Compliance Audits setup page, select Manage next to Manage User Access.
2. Select the tab for the permission set you want to assign.
   The available permission sets are:

   • Compliance Admin permission set: Assign to audit managers and compliance officers who create audits, create evidence requests, and verify submitted artifacts.
   • IT Compliance Fulfiller permission set: Assign to internal users who work in the Evidence Hub app to upload artifacts and respond to evidence requests.
   • IT Compliance Submitter permission set: Assign to employees who fulfill evidence requests from the IT Service employee portal. This permission set is included in the IT Compliance Employee Permission Set License.
3. Select the users you want to assign the permission set to and select Assign.
4. Repeat for the other permission sets.
   Each tab shows the number of users currently assigned to that permission set, and the license card shows how many permission set licenses you've used out of the total available.

Set Up Files Connect

Connect Salesforce to external file sources such as Google Drive, OneDrive, and SharePoint so that fulfillers can attach evidence artifacts directly from those sources, without having to download and re-upload the files.

1. On the Evidence Management for IT Compliance Audits feature page, select Go to Setup next to Set Up Files Connect.
2. On the Files Connect Settings page, enable Files Connect and adjust the file sharing and link conversion settings to suit your org's policies.
3. Add and authenticate the external data sources you want fulfillers to be able to attach files from.
   For detailed instructions on configuring Files Connect and external data sources, see Salesforce Files Connect in Salesforce Help.

Turn On Evidence Artifact Download from Evidence Viewer

By default, evidence artifacts are reviewed inline in the evidence artifact previewer and can't be downloaded. Turn on this setting if your compliance process requires authorized users to be able to download artifact files from the previewer.

Unlock Advanced Functionality

The advanced settings let you tighten data quality, customize the evidence types your org uses, and integrate Evidence Management with the standard IT Service automation capabilities like SLAs, notifications, and stage management. All of these settings are optional — turn on only what your compliance program needs.

1. Create date validation rules on the Compliance Audit and Compliance Evidence Request objects.
   Use validation rules to enforce timeline rules like "Audit Execution End Date can't be earlier than Audit Execution Start Date" or to block the creation of records with invalid data. Select Go to Setup next to Create Date Validation Rule to open the standard Validation Rules page in Object Manager.
2. Manage evidence request types.
   The Type picklist on the Compliance Evidence Request object controls how requests are classified — for example, Documentation, Inquiry, Observation, Configuration, or Implementation Details. Add, deactivate, or rename values from Object Manager to match your audit program's taxonomy.
3. Define rules and criteria for evidence records using stage management.
   Stage management lets you define stages and step-level criteria for Compliance Evidence Requests and Compliance Evidence Artifacts, so records move through your defined workflow in a consistent, controlled way. To learn how stage management works in IT Service, see Stage Management for Agentforce IT Service.
4. Manage compliance service level agreements.
   Set up SLA policies and milestones on evidence requests so the system can track due dates, escalate at-risk requests, and report on compliance to internal SLAs. For details on how SLAs work in IT Service, see How Operational Level Agreements and Service Level Agreements Are Used in IT Services.
5. Set up notification channels.
   Multi-channel notifications keep evidence fulfillers, assignees, and compliance reviewers informed when an evidence request is submitted, rejected, or reassigned to them. Evidence Management ships with notifications such as Evidence Submitted Notification, Evidence Notification for Rejected Requests, and Compliance Evidence Request Notification, which you can enable across email, in-app, Slack, and Teams channels. For details on configuring notification channels, see Notifications for IT Services.

Provision Your Org with Sample Data

Populate your org with sample compliance audits, evidence requests, and artifacts so your team can safely explore and validate your Evidence Management configuration before going live.

1. On the Evidence Management for IT Compliance Audits feature page, select Deploy next to Deploy Sample Data.
2. Select which kinds of sample data you want to load — sample compliance audits, sample evidence requests, or both.
3. Confirm the deployment.
   Sample records are added to your org. They appear in the Evidence Hub app prefixed with [SAMPLE].