What's Changing?
We're making Upload Tests keep your evidence current on their own. Previously, an Upload Test could stay Passing indefinitely, even when its evidence was long out of date, because many tests had no interval set. That led to stale evidence going unnoticed and surprises at audit time.
This update introduces three connected changes:
Default intervals. Every Upload Test gets a default interval that defines how often fresh evidence is required.
Completion-date evaluation. Tests pass or fail based on the activity completion date of your evidence rather than its upload date.
The Expired status. Evidence that ages out of its interval is marked ⚠ Expired instead of being auto-archived, so it stays visible to auditors.
When this takes effect:
These changes go live on August 3, 2026. Any custom intervals you've already set are preserved exactly as they are — defaults only apply to tests that don't have an interval yet.
Default Intervals
An interval is how often an Upload Test needs new evidence to stay Passing. Starting at launch, every Upload Test has one.
Most tests default to Annual. Some, such as penetration testing, default to Quarterly, based on naming and how often that evidence is typically refreshed.
Your existing custom intervals are never overwritten. Defaults are only applied to tests that don't already have an interval.
You can still change or remove an interval on any test after defaults are applied.
When you change an interval, existing evidence is re-evaluated against the new schedule. For example, if a test moves from monthly to quarterly, your prior monthly evidence is grouped and assessed to see whether it satisfies the new quarterly window.
Completion-Date Evaluation
Secureframe now measures an interval from the activity completion date of your evidence — the day the underlying work actually happened — rather than the day the file was uploaded. Upload date often lags the real activity by weeks, which is a long-standing source of frustration for customers and auditors alike. Using completion date ties each piece of evidence to the period it truly represents.
Example - Quarterly Test
Mar 15, 2026: Your team runs a penetration test. This is the activity completion date.
Apr 10, 2026: You upload the report, with completion date set to Mar 15.
Jun 15, 2026: Next due date — three months from Mar 15, not Apr 10.
Secureframe evaluates this test against March 15, so the next evidence is due June 15, 2026. Setting the completion date accurately on every upload is the single most important thing your team can do to keep tests scheduled correctly.
New "Expired" status
When a test's most recent evidence falls outside its interval window, that evidence is now marked ⚠ Expired. This replaces the old behavior of automatically archiving out-of-date evidence.
Expired evidence behaves differently from archived evidence in one important way:
It stays visible to auditors. Expired evidence remains in scope in the Audit Module, so historical, in-scope evidence still appears in an active audit. Nothing disappears from an auditor's view just because its interval elapsed.
You can still archive evidence manually. If you want a piece of expired evidence off the test entirely, archive it yourself.
What to Expect at Launch
When defaults turn on, any Upload Test whose most recent evidence falls outside its new interval window will move to At Risk or Failing. This is expected, as it reflects evidence that was already out of date. Each affected test shows a banner (see photo above) with the exact completion-date range your next evidence needs to fall within. Upload qualifying evidence and the test returns to Passing.
How to get a test passing again:
Open the affected test and read the banner. It lists the completion-date range your evidence must fall within.
Upload evidence with a completion date inside that range. Set the activity completion date to the day the work actually took place, not the day you're uploading.
Reactivate auto-archived evidence if it still qualifies. If qualifying evidence was auto-archived before this change took effect, open it and set its status back to Active so it counts toward the test.
Confirm the test returns to Passing. Once active evidence sits inside the interval window, the banner clears and the status updates.
💡 Tip
If a test went to Failing right after launch, check whether you already have qualifying evidence that was auto-archived under the old behavior. Reactivating it is often faster than collecting something new.
Frequently Asked Questions (FAQ)
Will this change the intervals I already set?
No. Custom intervals are preserved. Defaults are only applied to Upload Tests that don't already have an interval.
Can I remove a default interval?
Yes. You can change or remove the interval on any Upload Test after defaults are applied. Removing an interval means the test won't require periodic refreshes.
Why did several of my tests suddenly move to At Risk or Failing?
Those tests had evidence whose completion date already sat outside the new interval window. The status change surfaces evidence that was out of date rather than leaving the test passing on stale evidence. Upload qualifying evidence to resolve it.
What's the difference between Expired and Archived?
Expired evidence has aged out of its interval but stays visible to auditors in the Audit Module. Archived evidence has been manually removed from the test and isn't evaluated. Expired evidence is never auto-archived — that only happens if you choose to archive it.
Does upload date matter at all anymore?
Upload date is still recorded and shown, but it no longer drives pass/fail or due dates. The activity completion date is the source of truth for interval timing.
What if my evidence doesn't have a completion date?
Set one when you upload. Because completion date now determines whether a test passes and when the next evidence is due, keeping it accurate is essential.