2025-11-05
Evidence packs that survive examiner walkthroughs
Screenshots alone rarely satisfy. Structure artefacts so system owners can narrate them under pressure.
Strong evidence packs group artefacts by control objective: access, change, logging, backup, and incident response. Each folder opens with a one-page narrative naming the system owner, the period sampled, and how the artefacts prove the control operated.
Prefer exportable tickets, signed change records, and restore test logs over ad-hoc screenshots. When screenshots are necessary, capture the URL, timestamp, and account context in the same frame.
Rehearse the walkthrough once with an internal challenger who was not involved in assembling the pack. Gaps that surface in rehearsal are cheaper than gaps that surface with an examiner.