What security evidence should a CMS vendor provide in a financial services RFP?

“Ask for evidence issued or retested within the last 12 months rather than whatever was current at the last audit cycle. A compliance certification says an audit was passed, while compliance evidence shows when it happened, who performed it and what was tested.”