Your company already has a penetration-test report. Uploading the PDF gives the team a place to keep it, but the compliance workflow still needs to know what was tested, when the work happened, and whether someone has reviewed the evidence.
In the Sythe platform, Prior external assessments connects that report to a structured record. Registration preserves the report's actual scope and dates. Evidence review and eligibility are separate steps, so a file in the library does not silently become proof that every related check passed.
Registration starts with a processed report
Open the command palette and search for Prior external assessments. You need permission to register external assessments to see the write controls. The supported report types are SOC 2 Type I, SOC 2 Type II, and penetration tests. Choose the type of the source report; a SOC 2 report is not a substitute for a penetration-test report.
Use Upload prior assessment if the file is not already in your document library. Wait for processing to finish before selecting it under Link existing report. If the document is already there, choose the existing file instead of uploading another copy merely to make it appear in this workflow.
Registration uses a processed, readable document version. If processing is incomplete, resolve that first. A filename that says “final” is not enough to establish that the platform has a usable report.
Scope and dates determine what the report covers
In Register prior assessment, enter the report's actual metadata. A Type I report has an as-of date. A Type II report or penetration test has an assessment period. The issuance date describes when the report was issued; it does not replace the dates of the underlying work.
Read the scope and exclusions before entering them. For example, a report covering one application should not be described as an assessment of the entire organization. That distinction can determine whether an organization-level check can use the record.
An older report can remain in history after it stops qualifying for a current check. Preserve its original dates so the next reviewer can see which assessment the record describes.
Registration leaves the review decision open
After registration, choose Open evidence and review. Assign an approver and submit the evidence through the review workflow. Registration alone does not record acceptance.
The reviewer should be able to connect the report, its pinned version, and the entered scope without guessing. If the metadata overstates the report, correct the record before asking someone to rely on it.
An assessor's name is an attribution field. Entering it does not establish that the assessor was independent, and accepting evidence does not certify the organization. Those judgments require their own supporting facts.
Accepted evidence can still be ineligible for a check
Inspect the registered report's eligibility explanations after review. A report may be accepted evidence yet unsuitable for a specific check because of its scope, dates, or current source state. The platform's check windows are implementation rules for those checks, not universal legal deadlines.
If the source report changes, use Correct or replace and review the resulting evidence state. If the registration should no longer be used, withdraw it rather than trying to disguise the problem with new metadata. The withdrawn registration remains part of the history.
Sythe-delivered penetration-test reports already belong to their engagement workflow and cannot be registered again as external assessments. Before commissioning more work, identify the precise gap: an unreviewed report, an outdated assessment, or a scope that never covered the system you need to assess.