What scan records auditors ask for (MLPS / supply chain)

Audit week asks for “security scan records,” and the folder only has green CI screenshots—no policy version, no frozen report, no who approved exceptions. Questionnaires want an evidence chain, not th