Scan Hub 證據包：為審計、網絡保險及續約提供漏洞處理證據

Key takeaways

• Every tracked finding now has a fix deadline, and a past due list shows what is late and by how many days.
• When a client won't fix something, they can accept the risk by signing online, with a reason and an end date.
• A proof pack turns 30 to 365 days of that history into a white-label PDF: what was fixed and proven, what is open, what was accepted.
• It maps the evidence to common control frameworks and insurance questions, and it never claims a control is met.

The question every report leaves open

A vulnerability report says what is wrong today. Auditors, cyber insurers and clients at renewal ask something else: "Show me what you did about it." The answer is usually spread across old reports, tickets and email threads, and someone spends a day pulling it together.

We built the proof pack to answer that question from records Scan Hub already keeps. It has three parts that work together: fix deadlines, risk acceptance and the pack itself.

1. Fix deadlines and the past due list

Each finding Scan Hub tracks gets one due date: its priority band's deadline, counted from when it was first seen, or the CISA KEV due date when that comes sooner.

• Set deadlines once for your whole organization, and give a client its own when its contract says something different.
• Each client's overview shows a Past due list with days late, and how many fixes landed on time in the last 90 days.
• Fix these first shows each finding's due date.
• A fix counts as on time only when the rescan that proved it ran by the due date. Saying it was patched is not enough.

Not sure what deadlines to use? See how to set remediation SLAs.

2. Risk acceptance with an online signature

Some findings won't be fixed: a legacy system, a vendor that hasn't shipped a patch, a cost the client won't pay. That is the client's decision, and it should be written down. In Scan Hub an owner or admin records it with a reason, an optional compensating control and an end date no more than 12 months away. Then either:

• Record an acceptance you already have, from an email or a meeting, or
• Ask the client's contact to sign online. They get a one-time link that lasts 14 days, read the exact wording, and sign by typing their name, or decline.

The wording, the signature and the time are kept together. While an acceptance is in force, the finding stays open (it is never counted as fixed) but it is not past due. You get an email 14 days before it ends, so it is reviewed rather than forgotten. See how to document risk acceptance for what a good acceptance says.

3. The proof pack

Pick a client and a period (the last 30, 90, 180 or 365 days), add a cover note if you like, and Scan Hub builds a white-label PDF from the facts:

• What was fixed and proven by a rescan, on time or late against its deadline.
• What is open, what is past due and what is accepted, with how each acceptance was signed.
• The tickets sent to your PSA and the scans the pack is based on.

Code gathers these facts and freezes them in a facts file. Its SHA-256 is the pack's fingerprint, printed in the PDF. You can download the PDF, a CSV of the lists and the facts file itself, so an auditor can recompute the fingerprint and confirm nothing was changed.

Control map and insurance questions

A pack can map its evidence to CIS Controls v8, NIST CSF 2.0, the HIPAA Security Rule and CMMC Level 2. You choose which. Each row prints the evidence the pack holds for that control, or says plainly that it holds none. No row ever says a control is met: that is the auditor's call, not ours.

You can also tick the questions cyber insurers commonly ask, such as how often you scan, how fast you fix and what is still open. Each answer is the evidence from the pack: scans run, fix deadlines and median days to fix, known-exploited issues, what is past due, accepted risks and tickets.

Evidence, not certification. A proof pack is evidence for your own audit, insurance and client work. It does not certify anything or state that a standard, regulation or insurance requirement is met.

Where AI fits, and where it doesn't

AI writes one thing: a short cover summary. It works only from the pack's counts and dates, and every number it writes must point to one of those facts, or the summary is rejected. It is not allowed words like compliant, certified or audit-ready. It never receives the client's name, the reasons for an acceptance or who signed it. If its draft fails the checks twice, the pack uses fixed wording instead. The method page says when AI wrote the summary, and you can turn it off for any pack.

Everything else in the pack comes straight from your records. That is what we mean by evidence-led.

How to start

1. Set your fix deadlines in Settings, and a client's own deadlines if they differ.
2. Keep scanning each client with the same settings, so fixes are proven by a rescan. Proof of fix shows the changes in every report.
3. Record risk acceptances as they happen, not the week before the audit.
4. Make a proof pack for the period the auditor, insurer or client asks about.

A proof pack is paid for like a report: from your plan's monthly allowance, then one credit. If a pack fails three times, the credit comes back. Your first three reports are free, with no card needed. Create an account or see pricing.

Common questions

Does a proof pack make my client compliant?

No. It is evidence of the work done, mapped to controls so an auditor can find it quickly. Whether a control is met is the auditor's or insurer's decision.

What if the client won't sign a risk acceptance online?

Record the acceptance you already have, from an email or meeting notes, and say where it came from. The pack shows how each acceptance was made.

Can someone check the pack wasn't edited?

Yes. Download the facts file and compute its SHA-256. It must match the fingerprint printed in the PDF.

Originally published at varaxontech.com. Scan Hub is listed on Microsoft Marketplace and the ConnectWise® Marketplace, and it can push fixes into ConnectWise PSA or HaloPSA as tickets.