What counts as evidence

What an assessor accepts

Documentation. The plan, the policies, the procedures. Establishes what is supposed to happen.

Interview. Asking the people who do the work. Establishes what they understand to happen.

Observation and artefact. Watching the thing, or examining an export, a log, a screenshot, a signed record. Establishes what does happen.

Assessments use all three and the strength of the conclusion comes from their agreement.

Where assessments actually turn

The policy says quarterly access reviews. The compliance owner says they happen. The evidence shows two in eighteen months. That disagreement is the finding, and it is more damaging than a control honestly recorded as not yet implemented.

Which means the useful preparation is not polishing the documents. It is checking that the documents, the people and the records tell the same story.

Four things offered as evidence that are not

An assurance. That the control operates, from somebody credible, with nothing behind it.

A policy alone. A statement of intent is documentation, not proof of operation.

A capability. That the system can do this, shown in a settings page, without a record that it did.

A single instance. One screenshot from today for a control that should have operated monthly for a year.

The property that cannot be created late

Most requirements concern something that happens repeatedly. The evidence therefore covers a span: twelve months of review records, a year of logs, a sequence of dated approvals.

No amount of effort in the final month produces a year of history, which is why the blog entry on running this as a project emphasises that the deliverable cannot be compressed at the end.

Four

Dated. Attributable to a person or a system. Unaltered, or alterable only in a recorded way. And intelligible to somebody who does not work here.

The last is the one that fails: an export nobody outside the team can read requires a translator, and the translator is the person being assessed.

Monthly, into one place

The habit from the blog entry on staying compliant. An hour, a folder organised by requirement rather than by system, and a note of what was added.

Organised by requirement is deliberate: it is how the assessor works and it means one artefact can be referenced against several requirements without duplication.

What you can show and how

Some evidence contains information you would rather not hand over, including personal data and security configuration. Redaction is acceptable, showing on screen rather than providing a copy is acceptable, and refusing outright is not.

Agree the approach with the assessor beforehand rather than negotiating it in the room.

Elsewhere in getting assessed

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• Segmentation, and what it does not solveSegmentation, and what it does not solve. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.