Secureframe now counts evidence from before your observation period. What it means for a first Type II
4 min read
Secureframe's October 2026 product updates say its Audit Module can now include evidence gathered shortly before an audit's observation period: up to six months before for a three-month window, up to three months before for a six-month window, and none for nine- or twelve-month windows. For a startup choosing a short first Type II window, the readiness months are no longer dead time for evidence, subject to the auditor's acceptance. The other four tools do not publish an equivalent rule.
What did Secureframe change?
Four things in October: the evidence lookback, with Secureframe's own note that evidence must accurately reflect practice and meet the audit's requirements; a Custom tests tab that lists every test a customer created, mapped or not; Virtual Desktop environments that deploy in about 30 minutes; and a free CMMC gap assessment on CMMC.com. The lookback is the one that matters for a first audit.
Why does the observation period matter?
A Type I report looks at control design at a point in time. A Type II also tests whether controls operated over a period, usually three to twelve months. Our lesson on Type I versus Type II explains the choice. The trade-off has always been that a short window gets you a report sooner but gives the auditor less history to test. A lookback changes that slightly: with a three-month window, evidence from the six months of readiness before it may now be considered, so the controls you switched on in month one have a longer record by the time the auditor looks.
What does it not change?
The auditor decides. Secureframe's note says evidence should accurately reflect your security practices and meet the requirements of your audit; the lookback is a platform feature, not an auditing standard. Ask your auditor before you plan around it. It also does not help the longer windows: at nine or twelve months there is no lookback.
What should you ask the other tools?
Two questions. Does the audit module accept evidence collected before the observation period, and on what terms? And does evidence keep its original collection date if you import it from another system? Scytale, Vanta, Thoropass and Comp AI do not publish an answer on the pages we read. Thoropass, which runs the audit in-house, is the one most able to answer the first question directly.
What should a founder do with this?
If you are planning a three-month first Type II, start evidence collection now rather than at the window's start, whichever tool you choose, and ask the auditor how much of it will count. If you are on Secureframe, the lookback makes that plan explicit. Either way, keep the list of custom tests exportable: it is the part of your programme that does not come with the template.
Sources
- Secureframe product updates, October 2026Source: secureframe.com · Read 2026-11-05
Questions founders ask
Does Secureframe accept evidence from before the observation period?
Per its October 2026 product updates, up to six months before for a three-month audit window and up to three months before for a six-month window; none for nine- or twelve-month windows.
How long should a first Type II observation period be?
Three to twelve months; three months gets a report sooner and twelve gives the auditor more history. See our lesson on Type I versus Type II.