On this page
- Keep readable documents and structured records together.
- Preserve the manifest and the identity of the assessed inputs.
- A generated SBOM projection is not a lossless copy of a supplied SBOM.
Start with the question a future reader will ask
Six months from now, someone may need to know which release a finding concerned, whether the result was already stale when exported and where a statement came from. They should not have to recognise your folder naming habits to answer those questions.
Keep a short contents guide beside the files. Name the product, release, assessment run and export date, and identify the known limits. Store the record where the right people can find it and where access is appropriate for the evidence it contains.
What to expect in a ConformOps evidence package
A paid evidence package is tied to a completed assessment run. It includes a usage guide and a file manifest with hashes and recorded run and release identity. Readable Markdown, structured JSON, CSV registers and XLSX workbooks serve different readers; keep the relevant files together rather than selecting the prettiest one.
The generated Annex II, Annex V and Annex VII material remains working documentation. Missing information and human approval boundaries do not disappear when the files leave the application. A declaration template is not an issued or signed declaration.
| Part of the record | Why keep it | Limit |
|---|---|---|
| Usage guide and file manifest | Identify the package and check its contents | An unsigned manifest does not prove who created it |
| Readable documents and workbooks | Let a person inspect findings and missing information | Presentation does not establish conformity |
| Structured JSON and CSV records | Support later analysis and transfer | Check the field meanings before importing elsewhere |
| Relevant supplied SBOM and generated projection | Distinguish retained source detail from normalized inventory | The projection does not preserve every supplied field |
Do not mistake an SBOM projection for the original
A supplied CycloneDX or SPDX document may carry relationships, licences, hashes and other detail that does not appear in a normalized inventory. ConformOps's generated CycloneDX projection is not a lossless conversion of that supplied document. The separately retained sanitized supplied document remains the reference for its retained detail.
Keep your own original under your organisation's controls as well. The service records a fingerprint of the supplied bytes and a separate hash for the retained sanitized artifact. A difference between those identities is not automatically corruption: they describe different byte sequences.
The SBOM evidence guide explains supplied and derived inventory. Neither a usable supplied file nor a generated projection proves that every component in the shipped product was captured.
Open the copy before you rely on it
Extract the archive in an appropriate environment and open the usage guide first. Check the release identity, the list of files and the stated baseline condition. Confirm that the readable documents open and that your spreadsheet tool can read the registers. If large outputs arrive in multiple parts, preserve every part.
Compare file hashes with the manifest when checking integrity. A matching hash shows that the file matches the value recorded in that manifest. It does not establish legal completeness, and an unsigned manifest is not independent proof of origin.
Later working histories can also matter. Approval, gap resolution and affectedness records may describe decisions made after an immutable assessment artifact was generated. Export the relevant available histories separately and keep their dates, rather than pretending the original artifact contains later decisions.
Plan retention separately from cancellation
An independent copy helps your organisation maintain its own record. It does not replace the need to decide who controls it, how long it is retained and how access or deletion requests are handled. An evidence package may contain sensitive material even after source sanitization.
The cancellation guide explains historical access and the difference between ending coverage and deleting a product. Before leaving any service, use the exit checklist and actually open the files you plan to retain.
Frequently asked questions
Can I export the complete evidence package on the Free preview?
No. The Free preview does not include complete evidence exports. Paid Full Assessment access and applicable historical access provide exports for the accepted assessment scope.
Is the generated CycloneDX file a complete copy of my uploaded SBOM?
No. It is a normalized component projection and does not preserve every original field or dependency relationship. Keep the separately retained sanitized supplied document and your own original with their distinct provenance.
Does the file manifest prove that the evidence is authentic?
Hashes help detect changes relative to the manifest. An unsigned manifest is not independent proof of origin, accuracy, completeness or CRA compliance.