<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Audit Readiness Programs — API Reference

## Evidence Management Schema

```json
{
  "control_id": "CC6.1",
  "control_name": "Logical Access Security",
  "evidence_type": "screenshot",
  "evidence_file": "mfa-config-2026-Q1.png",
  "collection_method": "automated",
  "collected_date": "2026-01-15",
  "audit_period": "2026-01-01 to 2026-12-31"
}
```

## Agent Commands

```bash
# Check evidence readiness
node agent.js --action check --input controls.json --evidence-dir /evidence

# Run mock audit
node agent.js --action mock-audit --input controls.json --evidence-dir /evidence

# Generate readiness report
node agent.js --action report --input controls.json --evidence-dir /evidence --output report.json
```

## Audit Finding Classification

| Type | Severity | Impact | Response Time |
|------|----------|--------|---------------|
| Observation | Low | Minor improvement | 90 days |
| Deficiency | Medium | Control gap | 60 days |
| Significant Deficiency | High | Material control weakness | 30 days |
| Material Weakness | Critical | Reasonable possibility of material misstatement | Immediate |

## Evidence Automation Tools

| Tool | Purpose | Evidence Type |
|------|---------|---------------|
| Vanta | Continuous compliance | Config, access, training |
| Drata | Automated evidence | Cloud config, policies |
| Prowler | Cloud posture | CIS benchmark results |
| Chef InSpec | Infra compliance | Configuration tests |
