Data center DR evidence your audit team can re-perform

What we produce

• Validated inventory and L2/L3 topology from read-only API capture from management planes.
• A cross-tier dependency map and recovery runbooks ordered by it.
• Automated compliance reports with per-framework gap analysis, with evidence pointers on every finding.
• A witness bundle: every source capture, validation logs, and an integrity manifest with the SHA-256 of each file.

Why it lowers the cost of testing

Recovery evidence is usually assembled from interviews, screenshots, and documents that describe intent. Testing it means sampling and follow-up rounds. Each MKDC finding instead traces to a capture your team can re-perform directly.

What your auditor does with the bundle:

1. Checks file hashes against the integrity manifest to confirm nothing changed after delivery.
2. Picks a finding in a framework report and follows its evidence pointer to the source capture.
3. Re-derives the conclusion from the capture and validation log, without MKDC on the call.
4. Records the re-performance in their own workpapers, as with any other evidence.

Evaluating MKDC as the client's specialist

Before relying on our output, your team needs to judge how it was produced. Each engagement gives you:

• Access scope in writing: the management-plane APIs we read, with read-only credentials and no agents or production changes.
• A run record for every capture: tool version and code commit, the operator account that ran it, capture time, the sources captured, and whether strict reproduction checks ran.
• The raw source captures next to the compiled estate model, so you can inspect how we normalized vendor data.
• Validation results that label each check passed, partial, or failed — partial coverage is stated, not hidden.
• A methodology note covering capture, normalization, validation, and what we do not attest to — available before any engagement.

When your audit finds a DR gap

Independence rules keep your firm from remediating what it audits. When a client needs its estate documented, its dependency map rebuilt, or its runbooks brought in line with what is running, MKDC is a non-conflicted option the client engages directly — and your team then tests the result like any other evidence.

Independence and contracting

Advisory, not formal attestation. MKDC does not sign attestations, audit opinions, or reports.

The client engages MKDC and your firm under separate contracts, and no fees pass between our firms. Your team tests our output as it would any evidence the client or its consultants prepare — the witness bundle is built to make that testing straightforward.

Where it fits

• FFIEC BCM — technical recovery evidence for the independent audit of the business continuity program.
• SOC 2 — CC9 and availability criteria for service organizations with on-premises infrastructure.
• SOX ITGC — recovery evidence tied to validated inventory.
• ISO 22301 — operational clauses; certification stays with an accredited certification body.

What we do not do

• Sign attestations, audit opinions, or certifications.
• Facilitate tabletop exercises or live failover tests.
• Replace your testing procedures or sampling judgment.
• Capture scopes with no on-premises data center.