Information technology infrastructure comprises a computing environment shared by multiple tenants of a service provider, and a secure assessment environment separate from the shared computing environment. An evidence collection module associated with the shared computing environment collects compliance evidence from the shared computing environment for storage in the secure assessment environment. A tenant assessment interface to the secure assessment environment is provided, through which the tenants can access the compliance evidence as stored in the secure assessment environment in a manner that does not undermine security of the shared computing environment. The compliance evidence may include, for example, information sufficient to allow a tenant to verify that the shared computing environment is configured in accordance with a specified security policy. In an illustrative embodiment, the information technology infrastructure comprises cloud infrastructure of a cloud service provider and the shared computing environment comprises a cloud computing environment.