Leave evidence where it already is.
Instead of uploading every file, you link to its location in your storage for measures, exceptions, assets and evidence. Varmo stores the address, the title and the date it was last checked.
- In all plans
- Any https address
- Varmo never retrieves the address itself
- Measures
- Exceptions
- Assets
- Evidence
- SharePoint
- OneDrive
- Confluence
- Intranet
- Address
- Title
- “Last checked on”
- Content of the file
- Preview
AT A GLANCE
In Varmo, a link to an https address can be recorded as evidence instead of a PDF file for measures, exceptions, assets and under Documents & evidence; Varmo never retrieves the address itself.
Requirements
- Access: Access to Varmo, in any plan
- In Varmo: The right to add attachments to the entry (as for uploading a file)
- Address: An https address without a user name or password, e.g. from SharePoint, OneDrive, Confluence or your intranet
Where links are possible
Link possible
- Measures, exceptions and assets: in the “Attachments” section next to the upload
- Documents & evidence: as a new version of an evidence item; it applies immediately and is recorded in the history
File still required
- Controlled documents with approval, policies, Statement of Applicability (SoA)
- Audit reports and runs of internal controls and recurring measures
Wherever an approved or completed version must be fixed, the PDF file remains mandatory: a link always points to the current version in the target system and can change.
Add a link
Step 1: Choose “Add link”
In the “Attachments” section of the entry or for an evidence item.
Step 2: Paste the address
It must start with
https://, without a user name or password.Step 3: Enter a title
E.g. “Backup test report 2026”.
Step 4: Add the check date
Optional: “Last checked on” – when someone last checked the content.
Varmo shows the link to everyone allowed to see the entry. However, only people with access in the target system (e.g. SharePoint) can open it. Before an audit, check whether the auditors have read access there, or store a PDF file for the audit.
Data protection and security
- No retrievalVarmo never retrieves the address itself and creates no preview.
- https onlyOnly secure addresses (https); other kinds of addresses are rejected.
- LoggedAdding and deleting are recorded in the change log.
- In the exportThe links are included in the data export (ZIP).
Frequently asked questions
Does Varmo download the linked file?
No. Varmo only stores the address, the title and the date it was last checked. Varmo never retrieves the address itself and creates no preview.
Can auditors open linked evidence?
Only if they have read access in the target system (e.g. SharePoint). Check this before the audit, or store a PDF file for the audit.
Where is a PDF file still required?
Wherever an approved or completed version must be fixed: controlled documents with approval, policies, the Statement of Applicability (SoA), audit reports and runs of internal controls and recurring measures.
How close are you to ISO/IEC 27001?
In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.