MSP
The handover document is already wrong
The as-built is accurate the week you onboard the tenant. The next emergency change is not in it.
A compliance export. A shot of the as-built next to the tenant it describes would be better.
Engineers do not update the document. They fix the tenant. By the service review, the PDF in the folder and the policy in Zscaler are two different systems. The investigation starts by guessing which one is real.
NUMBAT writes the record from the tenant as it is now. Who changed what is already in the audit log. The as-built is that state, not a file someone was supposed to maintain.
When an auditor asks, Essential Eight, ISO 27001, NIST CSF and SMB1001 are a PDF of the live config. Not a spreadsheet last touched in March.