ASSURANCE

Evidence

How evidence supports control validation, incident reconstruction and assurance conclusions.

Evidence principles

Relevance to the requirement and scoped system.
Reliable provenance and integrity.
Sufficient depth and period coverage.
Reproducibility where technical testing permits it.
Transparent limitations and contradictory evidence.

Evidence types

TECHNICAL

System evidence

Configurations, logs, telemetry, model artefacts, test outputs and validation records.

OPERATIONAL

Process evidence

Tickets, approvals, playbooks, exercises, incidents and remediation records.

GOVERNANCE

Decision evidence

Policies, risk decisions, exceptions, committee records and accountability artefacts.

INDEPENDENT

Third-party evidence

Supplier assurance, external testing, audit reports and independent evaluations.

Notably absent

Evidence availability does not itself prove effectiveness. Evidence must be evaluated against the requirement, system context, test method and contradictory observations.