What evidence is
Evidence is anything that shows a security requirement is actually implemented. Your System Security Plan says what you do; evidence shows that you do it.
NIST SP 800-171A, the assessment guide behind CMMC, describes three ways an assessor checks each objective:
- Examine: look at documents, settings, and records.
- Interview: talk to the people who do the work.
- Test: watch something happen, such as a login prompting for a second factor.
Good evidence lets the assessor do all three without surprises.
Kinds of evidence
- Policies and procedures: what the rule is, and how the work is done.
- Configuration evidence: screenshots or exports of settings, such as password rules, MFA enforcement, or firewall rules.
- Records of activity: account reviews, log reviews, vulnerability scan reports, training completions, visitor logs, incident response exercises.
- Inventories and diagrams: asset lists and network diagrams, kept in step with the SSP.
- Agreements: provider service descriptions and customer responsibility matrices.
Settings versus activities
Some requirements are settings: once configured, they stay that way until someone changes them. Others are activities that must keep happening: reviewing logs, reviewing who has access, training staff, scanning for vulnerabilities.
Activity evidence goes stale. A screenshot of a log review from last spring does not show that logs are reviewed now. For each recurring requirement, decide how often it happens, who does it, and what record it leaves, then keep those records as they are produced rather than hunting for them before an assessment.
Organizing it
- Organize by requirement, and ideally by assessment objective, so every item in your SSP points to its evidence.
- Date everything. Undated evidence is hard to rely on.
- Name an owner for each recurring activity and its records.
- Keep versions. When a policy or setting changes, keep the old version and note when the change happened.
How long to keep it
For CMMC self-assessments, the artifacts used as evidence must be kept for six years from your CMMC status date. Plan your storage for that from the start.