Compliance evidence collection: what auditors accept versus what actually proves security | Vulnox Blog