How do you turn Wiz into SOC 2 and ISO 27001 evidence?

Read-scoped API credentials that you create and control. Screenata uses them to sync findings on a schedule and never receives write access to your Wiz tenant. You can revoke them at any time.

No. Wiz finds the cloud risks; Screenata governs them. The sync feeds Wiz findings into a risk register with owners, treatment plans, and human-approved acceptances, which is the record an auditor tests.

They become risk register entries linked to controls. What auditors see is the governed record: the risk, its assessment, its owner, and its treatment history, all signed like any other artifact. Risk acceptance always requires human approval.

First, create read-scoped API credentials and connect them. Second, let the first sync run so the baseline is the set of findings Wiz actually sees across your cloud estate, deduplicated against risks you already track. Third, work the register down: confirm every account and subscription is in Wiz coverage so nothing sits outside the program, give each synced risk an owner, a treatment plan, and a due date, and close the critical findings inside the timelines your vulnerability management policy sets, with any acceptance approved by a named human rather than left implicit. Fourth, leave the scheduled syncs running so the register and its treatment history accumulate as signed evidence across the observation window, which for a Type 2 report is usually three to twelve months. Fifth, hand the evidence package to an independent auditor. The audit is a separate engagement with a licensed CPA firm, which issues the report; Screenata prepares and holds the evidence it asks for.

Three things. Coverage across the whole estate, so the scanned population matches the asset register and no account, subscription, or workload sits quietly outside the program. A documented severity triage with remediation timelines, so critical and high findings have a defined window rather than an open-ended one. And a record showing findings were actually worked down inside those timelines, not just discovered. Detection is the easy half. The finding auditors write up is the open critical that sat past its own deadline with no owner.

Yes. Every finding is exported as a signed, timestamped artifact, a SHA-256 hash with an RSA or ECDSA signature and an RFC 3161 timestamp, that an auditor verifies outside Screenata with a free CLI. A person reviews and approves the evidence before it reaches the auditor. Screenata collects and signs it; it does not decide the audit result.