Evidence is not a file you attach

Ask a team where its compliance evidence is and you will usually be shown a folder. Inside it are exported spreadsheets, screenshots with names like image seven, a policy in three versions, and a document called final that has been edited twice since.

Every one of those files was added in good faith. Almost none of them will help in an audit, because none of them says what it proves. A reviewer opening the folder has to work out which file relates to which requirement, whether it is still current, and whether anyone ever checked that it shows what it is supposed to show. Most of the time, they give up and ask for it all again.

The fix is not more evidence. It is treating each piece as a small claim of its own.

Tie it to the requirement it proves

A control in a framework like PISF usually contains several requirements, and each requirement is tested by specific statements. An access control might ask for a documented policy, for reviews at a set interval, and for leavers to be removed promptly. Those are three different things, and they need three different kinds of proof.

So evidence should attach to the requirement, not to the control as a whole, and certainly not to a folder beside it. When a reviewer opens the requirement about leavers, the export showing leavers removed should be right there, and nothing else should be.

CyberNexus

Demo environment, sample dataAzbersInnovations

This also makes gaps obvious. If a requirement has no evidence attached, it shows as empty, which is far easier to notice than a folder that looks full.

Record the period, not just the file

Evidence goes stale. An access review proves that access was reviewed on the day it was done, and for as long as the control says reviews are valid. After that, it proves only that access was once reviewed.

Every piece of evidence should carry the period it covers, and the system holding it should notice when that period ends. An evidence expiry report that lists what has quietly lapsed is one of the most useful things a compliance team can look at every month, because stale evidence is the most common reason a confident answer falls apart in review.

Treat uploads as untrusted input

Evidence arrives from many people, often in a hurry, sometimes from outside the organisation. From a security point of view, a compliance platform that accepts uploads is accepting untrusted files, and then asking reviewers to open them.

That deserves the same care as any other file intake.

• Decide what a file is from its content, not from its name, so a script renamed as a PDF is caught.
• Refuse documents that carry active content, such as PDFs with embedded scripts, and files built to look like two formats at once.
• Record a hash of every file, so you can later show it has not changed since it was accepted.
• Keep files where users cannot address them directly, and let them download only through the platform's own checks.
• Where your policy allows it, check files against known malware before anyone opens them, and hold anything flagged in quarantine until a person decides.

None of this is exotic. It is exactly what you would expect of any system that takes files from the public, and a compliance platform, which holds a map of where an organisation is weak, deserves at least that.

Present is not the same as accepted

The last distinction is the one most programmes skip. A file being attached means somebody believed it was relevant. It does not mean anybody checked.

A reviewer should record a judgement on each piece of evidence. Does it support the claim, support it partly, or not support it? That judgement should carry their name and the date, and it should be kept even if the file is later replaced. When a regulator asks why a control was accepted, the answer is then a specific person's recorded view of specific evidence, rather than the fact that a folder was full.

AI can help here, and we use it for this. It can read a long document and flag where it looks thin or mismatched against the requirement. It should never make the judgement itself. A flag is a reason for a person to look more closely, not a verdict.

What to change this quarter

You can make most of this difference without new tools.

1. Stop using shared evidence folders for anything new, and attach each file to the requirement it proves.
2. Add a covers until date to every piece of evidence, and review what has lapsed once a month.
3. Agree what file types you accept, and make sure uploads are checked by content before anyone opens them.
4. Ask reviewers to record supports, partly supports or does not support, with their name, for every file they look at.

If you are preparing for PISF, the requirement level approach matters even more, because reviewers will test answers statement by statement. Our guide to what happens between a PISF submission and a certificate walks through how that review works.

Common questions

What counts as good compliance evidence

Evidence that is attached to the specific requirement it proves, is current for the period that requirement covers, is the kind of proof the requirement asks for, and has been reviewed and accepted by a named person.

How long is compliance evidence valid

As long as the control it supports says it should be. A quarterly review is valid for a quarter. Each piece of evidence should record the period it covers so that lapsed evidence can be found before a reviewer finds it.

Why check evidence files for malware

Because evidence is uploaded by many people and then opened by reviewers, which makes it an easy route for a malicious file. Checking what a file really is, refusing active content and quarantining anything suspicious protects the people who have to open it.

Can AI review compliance evidence

It can read documents and flag where evidence looks weak or mismatched, which saves reviewers time. The decision to accept or reject evidence should stay with a person, and should be recorded against their name.