When the audit request lands, someone gets assigned "show evidence that credentials are inventoried, rotated and retired". In most Azure estates that means an afternoon of portal screenshots and a spreadsheet nobody fully trusts.
CertifyClouds produces evidence for the technical controls your auditor evaluates: a downloadable evidence package generated live from your Azure estate, with a per-file integrity manifest and a tamper-evident audit export. It is one input to your compliance programme, built to be verified rather than taken on trust.
The Evidence Package
One export: a PDF bundle with embedded CSV attachments, generated on demand from the latest scan of your subscriptions. Every number in it traces to a scan timestamp, and every attachment is bound to the cover page by its SHA-256 hash.
Cover Page That Binds the Bundle
Organisation, actor, license fingerprint, rule-set hash, and a per-attachment SHA-256 manifest. Re-hash any attachment and compare against the cover.
Inventory and Posture
Every secret, certificate and key across your vaults, plus per-vault recoverability: soft delete, purge protection, network access and RBAC state.
Rotation History
Date-windowed rotation records from the platform database: what rotated, when, and whether the new credential was verified in the target vault.
Cryptoperiod and Key Strength
Days-to-expiry for every credential measured against your configured policy thresholds, and key sizes and algorithms checked against minimum-strength rules.
Tamper-Evident Audit Export
The audit-log export carries a SHA-256 hash chain: each row's hash incorporates the previous row's. Genesis and final hashes are printed with a re-verification procedure.
Dependencies and Sync Provenance
Credential-to-resource dependency mapping with match confidence, and per-execution provenance for multi-cloud sync, so evidence covers where credentials are used, not just where they live.
Framework Mappings
Every check in the compliance engine is mapped to the controls auditors ask about. Each mapping carries an honest coverage label, in the product and in the exported package:
| Framework | Controls | Evidence | What CertifyClouds provides |
|---|---|---|---|
| CIS Microsoft Azure Foundations Benchmark | Section 8 (Key Vault) | Direct + supporting | Direct pass/fail evidence for vault recoverability (soft delete + purge protection) and RBAC authorization. Supporting evidence for key/secret expiry dates and private network access. |
| SOC 2 Type II (Trust Services Criteria, 2017) | CC6.1, CC6.2, CC6.3, CC7.1, CC7.2 | Supporting | Technical signals for the credential-lifecycle aspects of logical access, credential lifecycle, data protection, security configuration and monitoring. Your auditor still requires organisational policies, access reviews and audit procedures. |
| ISO/IEC 27001:2022 | Annex A.8.24 (Use of cryptography) | Supporting | Key and certificate lifecycle signals for A.8.24. Certification requires the full organisational control programme and an independent audit. |
| NIST SP 800-53 Rev. 5 | SC-12, SC-13, IA-5, CM-2, CM-3, CM-8 | Supporting | Supporting evidence across cryptographic key establishment and protection, authenticator management, baseline configuration, change control and component inventory. |
| Microsoft's cloud security benchmark | Key Vault and identity controls (DP, IM, BR, PA, NS, AM families) | Supporting | Supporting signals for key management, certificate management, application identity and asset lifecycle controls relevant to Key Vault. Use Defender for Cloud and customer evidence for the full benchmark. |
| HIPAA Security Rule, 45 CFR §164.312 | Access control, encryption, integrity, transmission security | Supporting | Supporting technical signals for four technical safeguards. §164.312(b) Audit Controls and §164.312(d) Person or Entity Authentication are customer responsibility (Azure Monitor diagnostic logging and Entra ID MFA sit outside CertifyClouds' scope). |
| PCI DSS v4.0.1 | Req 3 (key management), Req 8.6 (system account credentials) | Supporting | Supporting evidence for key management lifecycle, key protection and no-hardcoded-credentials checks. CertifyClouds is offered on the basis that customers do not provide cardholder data to it. |
Coverage labels describe technical contribution, not legal compliance. The same labels appear on every framework section of the exported package, so what your auditor reads matches what this page says.
What This Is Not
CertifyClouds is an evidence aggregator, not a certified compliance product. It does not certify, attest, or determine compliance. Your auditor makes that determination, using CertifyClouds' evidence as one input among many.
That sentence is printed in the evidence package itself, and it is the reason auditors can work with the output. CertifyClouds verifies cryptographic key and system-credential lifecycle controls in your Azure environment; it does not replace an audit, an assessor, or the organisational controls every framework also requires. It reads credential metadata only, never secret values, and is offered on the basis that customers do not provide protected health information or cardholder data to it.
The full legal framing, including the customer-responsibility model for the underlying controls, is published atdocs.certifyclouds.com/legal/compliance-disclaimer.
How Auditors Verify It
Re-hash the attachments
Each embedded CSV is listed on the cover page with its SHA-256. Extract the attachment, hash it, and compare. A single changed byte breaks the match.
Recompute the audit hash chain
The audit export chains every row: SHA-256 of the previous hash plus the row's canonical JSON, from a printed genesis hash to a printed final hash. Recomputing the chain proves the exported log was not altered after export.
Read the management assertion
The package includes a customer management assertion page in the style auditors expect under AT-C 105: the attestation your auditor relies on, alongside the technical evidence.