Audit exports

Control matrix CSV: one row per control with status, justification, owner, review dates and evidence. JSON audit bundle(owners/admins): frameworks, readiness, controls, evidence metadata with SHA-256 file hashes, evidence-to-control mappings, policies with every version and acknowledgement, members and the audit log.

Your auditor decides what is sufficient. Exports reflect what your team entered and don't constitute an audit opinion.