# AUD-002: Export audit and forensic evidence


- Area: Audit & Evidence

- Verification: Walkthrough
- OWASP adoption tier: Tier-independent
- Formerly: GOV-002
- URL: /r/AUD-002

**Acceptance criteria:** API, CSV, webhook or evidence package suitable for audit and incident response use.

**Why it matters:** Evidence has to leave the console in a form legal, HR and auditors can use.

**How to verify:** Export an evidence package for one pilot incident.

**OWASP adoption context:** Evidence export serves investigation and audit across adoption tiers; the relevant source and access restrictions still follow the records.

**Mappings:**
- NIST CSF 2.0: RS.AN-07; ISO 42001: A.6.2.8; SOC 2: CC2.1, CC7.3; ISO 27001: A.5.28 — Exportable AI-event and incident records provide usable information for incident analysis and evidence handling. Preserve source identifiers, times, provenance and integrity through export into the relevant evidence procedure. Format support alone establishes neither accuracy, completeness, chain of custody, recorded investigation actions nor an internal-audit program or incident decision.
- NIST AI RMF: GOVERN 4.3 — Evidence packages make AI-event information available to people responsible for testing, incident identification and information sharing. An export facility is an input to those practices, rather than the complete practice.