Policy is not enough
A policy describes intent. Evidence shows the control operated during a specific period, for a specific scope, with a known owner.
Good evidence qualities
- Time stamped
- Linked to a control owner
- Scoped to the relevant system or process
- Repeatable
- Approved or reviewed where required
Evidence examples
Access reviews, backup restoration tests, patch reports, incident tickets, configuration exports and change approvals can all support control evidence.