Skip to content
  • There are no suggestions because the search field is empty.

Preparing Documentation for Enhanced Virtual Examination (EVE) Analysis

How to prepare your files before uploading them to EVE

What to Expect

Enhanced Virtual Examination (EVE) reviews your existing documentation to identify where it supports specific compliance control objectives. It looks at what your documents say, flags anything that's unclear or incomplete, and traces every finding back to the exact location in your source files.

EVE does not confirm that controls are actively in place, verify that processes are being followed, replace the judgment of your assessor or team, or fill in gaps with assumptions. Your preparation is all about making sure your documents are clear and easy to follow, not about making a case.

What Kind of Documents Should You Upload?

EVE works best with documentation that describes how your organization operates or intends to operate. If a person reading the document couldn't understand it without someone explaining it verbally, EVE won't be able to either.

Good examples:

  • Policies with a clear scope, ownership, and defined responsibilities
  • Procedures with step-by-step instructions and assigned roles
  • Plans (such as incident response, business continuity, or disaster recovery) with triggers, timelines, and escalation paths
  • Contracts or SLAs with specific requirements
  • Logs or reports that include context like the system name, date, and purpose

How EVE Reads Your Documents

At a high level, EVE reads through the structure and content of your documents, compares what it finds to control objectives in the Secure Controls Framework (SCF), identifies areas where your documentation appears to align, flags anything that's partial or ambiguous, and links every finding back to the specific page and section it came from.

EVE is conservative. If something is unclear, it gets flagged rather than assumed.

Documentation Quality Checklist

Review the following before uploading your documents:

Structure and Clarity:

  • Clear title and document purpose
  • Defined Scope
  • Roles and responsibilities identified
  • Full sentences, not shorthand
  • Version number and last updated date

Self-Contained Meaning:

  • Acronyms defined inside the document
  • Internal process names explained
  • Cross-references included or clearly described

Evidence Context:

  • Logs or screenshots include the system name, date/time, what the artifact demonstrates

File Readiness:

  • Final documents only (not drafts)
  • No password protection
  • Scans are readable
  • Excel files contain no macros or VBA

Supported File Types

  • PDF (preferred)
  • DOCX
  • XLSX (no macros)
  • Image files with readable text

If your document has inconsistent formatting or structure, convert it to PDF before uploading.

Packaging Evidence for Best Results

We recommend combining related evidence into a single document for each control area whenever possible. For example, you could create an "Access Control Evidence Pack" as a PDF that includes a policy excerpt, a procedure excerpt, a sample access review, and an approval or review record. This makes it easier for EVE to see the full picture and reduces fragmented results.

If your evidence is spread across different systems or teams, that's fine. EVE can pull findings together across multiple uploads as long as each document makes sense on its own.

Common Causes of Weak or Confusing Results

  • Undefined acronyms or internal codes
  • Uploading only a policy with no supporting detail
  • Screenshots with no explanation
  • Draft or outdated documents
  • Excel files with macros or VBA

These won't cause EVE to fail. They just tend to produce incomplete or conservative results.

Final Readiness Check

Before uploading, confirm: 

  • A reader could understand the document without someone explaining it
  • Acronyms and internal terms are defined
  • The document reflects what's actually documented, not assumptions
  • Files are readable, final and unprotected

*A Note on Formatting and EVE Usage

EVE analyzes the text content in your documents, not how they look visually. Reducing font size, removing blank pages, tightening margins, or combining multiple documents into one file will not reduce your usage.

EVE usage is based on page volume, which is calculated using Azure Document Processing Standard. This method may differ from a traditional page count because it accounts for how documents are segmented, rendered, and formatted during processing. The number of pages EVE processes may not match the page count you see when you open a file.

Trying to optimize your documents for appearance can actually make them harder for EVE to interpret, leading to weaker results without any usage benefit. Focus on keeping your documentation clear and complete for the best outcome.

 

Related Articles