AUDIT AND EVIDENCE MANAGEMENT PROCEDURE

Evidence Library · Control Testing · Audit Intake · Auditor Response · Finding Tracking

Table of Contents

1. Purpose and Scope
2. Principles
3. Evidence Library Structure
4. Evidence Types and Quality Bar
5. Evidence Collection Cadence
6. Control Testing
7. Audit Intake and Response
8. Findings and Corrective Actions
9. Metrics
10. Roles and Responsibilities
11. Regulatory and Framework Alignment Summary
12. Document Control

1. Purpose and Scope

The README assigns audit response and control evidence to Cyber Governance. The Unified Control Baseline names evidence for controls. The compliance matrix maps intent to frameworks. The operational packages for CUI, NERC-CIP, and SOX depend on durable evidence. What was missing was the operating procedure that tells the organization how evidence is collected, stored, tested, produced to auditors, and tracked when it fails. This procedure provides that machinery.

This procedure governs CERG’s evidence library, control-testing cadence, audit intake, evidence production, auditor response, and finding tracking. It applies to every control framework CERG supports and to every audit, assessor request, regulator request, customer security review, and internal control test that depends on CERG evidence.

CERG-GOV-AUD-001 governs evidence quality, freshness, and sampling expectations. This procedure governs the operational workflow for collecting, storing, testing, producing, and correcting evidence. Where this procedure needs to judge whether evidence is acceptable, CERG-GOV-AUD-001 governs.

Evidence Is Produced by Running the Program

CERG does not create evidence by staging screenshots the week before an audit. Evidence is the exhaust of a working program: access reviews completed on schedule, vulnerabilities remediated or accepted, backups tested, keys rotated, risks reviewed, exceptions approved, controls measured. A program that runs well produces evidence naturally. A program that does not run well produces scramble folders.

2. Principles

1. Evidence is collected continuously. Audit readiness is a steady-state operating condition, not a seasonal project.
2. Evidence maps to controls. Every retained evidence item maps to at least one control, framework requirement, or audit request.
3. Evidence is attributable. Evidence shows who produced it, when, from what system or process, and what period it covers.
4. Evidence is reproducible. A reasonable reviewer can understand how the evidence was produced and, where possible, reproduce it.
5. Evidence is protected. Evidence often contains sensitive configuration, user, asset, or vulnerability data. It is classified and handled under CERG-STD-DG-001.
6. One evidence item can serve many frameworks. The same access-review record can support CMMC, SOX, ISO, and NIST. CERG collects once and maps many times.

3. Evidence Library Structure

The Evidence Librarian maintains the evidence library. The exact platform may vary by adopting organization, but the structure is fixed.

/evidence
  /control-baseline
    /<control-id>
      /<YYYY-QN>
  /frameworks
    /cmmc
    /nerc-cip
    /sox-itgc
    /iso-27001
  /audits
    /<audit-or-request-name>
      /requests
      /responses
      /submitted
      /findings
  /metrics
  /exceptions
  /attestations

The control-baseline view is the source view. Framework views may link to or reference the same evidence. The audit view contains exactly what was requested, what was submitted, when, and by whom.

Collect Once, Map Many Times

The control does not care which auditor asked the question. Access reviews, backup tests, vulnerability remediation, and risk reviews are real control activity. CERG stores evidence by control first, then maps it to CMMC, NERC-CIP, SOX, ISO, customer questionnaires, or internal audit. That prevents duplicate collection and prevents different audit teams from getting different versions of the truth.

4. Evidence Types and Quality Bar

4.1 Evidence Types

4.2 Quality Bar

Evidence quality is governed by CERG-GOV-AUD-001. Operationally, evidence is acceptable only if it is complete enough to support the control claim. At minimum it shows:

• what control or request it supports;
• what period it covers;
• source system or process;
• date generated or approved;
• owner or approver;
• scope, including included and excluded systems;
• result, decision, or conclusion;
• any exceptions or limitations.

A screenshot without date, scope, and source is weak evidence. A spreadsheet with no source and no owner is weak evidence. A ticket with approval, scope, timestamp, and closure is usually stronger than a polished narrative.

4.3 Evidence Retention

Evidence is retained according to the following schedule. Retention periods are driven by the most stringent applicable regulatory requirement for that evidence type.

Disposal Process

1. Trigger: Evidence retention period expired, system decommissioned, or legal hold released.
2. Authorization: Evidence Librarian confirms no active audit, investigation, or legal hold referencing the evidence. Governance Pillar Leader authorizes disposal.
3. Disposal Method: Evidence is securely deleted using methods appropriate to the storage medium (cryptographic erasure for cloud storage, secure overwrite for on-premises, physical destruction for removable media). A certificate of destruction is produced and retained.
4. Logging: Disposal is recorded in the evidence library audit log including: evidence ID, disposal date, authorizing party, method, and certificate of destruction reference.

Legal Hold Supersedes Retention Schedule

When a legal hold is in effect, evidence subject to the hold is preserved regardless of the retention schedule. The Evidence Librarian coordinates with Legal to identify and preserve evidence subject to hold, and disposal is suspended until Legal releases the hold in writing.

4.4 Evidence Integrity and Chain of Custody

Evidence must be protected from tampering, loss, or unauthorized modification throughout its lifecycle. The integrity of evidence is foundational to audit credibility and, in some cases, legal defensibility.

Integrity Controls

Chain of Custody

5. Evidence Collection Cadence

Evidence cadence follows the control’s operating cadence. Evidence is not all collected at year-end.

The Evidence Librarian maintains the evidence calendar and follows up with owners before due dates.

6. Control Testing

Control testing confirms that a control is not only documented but operating.

6.1 Test Plan

Each test plan records:

• control or requirement tested;
• population and sample method, if sampling is used;
• period under review;
• evidence used;
• expected result;
• test steps;
• tester;
• result;
• exceptions and corrective actions.

6.2 Sampling Methodology

Sampling for control testing follows the canonical sampling standard in CERG-GOV-AUD-001 §5. This procedure does not maintain a separate sample-size table.

The control test plan records:

• population definition and size;
• sampling method and rationale;
• sample size and how it was determined;
• selected items, including random seed or selection tool where random sampling is used;
• test results per sampled item;
• exceptions, substitutions, or untestable items;
• regulatory, assessor, or auditor-specific sampling requirements that override the CERG default;
• limitations or caveats.

If a regulator, assessor, auditor, or framework-specific operational package requires a different sampling method for an engagement, the engagement-specific requirement governs and the rationale is recorded in the test plan.

6.3 Testing Outcomes

Deficient controls create corrective actions under Section 8. A repeated evidence failure is treated as a control failure, not an administrative miss.

7. Audit Intake and Response

7.1 Intake

Every audit, assessor, regulator, customer, or internal evidence request enters through Governance and is recorded in the audit intake log.

Minimum intake fields:

7.2 Response Rules

1. Answer the request asked. Do not over-produce. Extra evidence creates extra review surface.
2. Submit through Governance. Evidence leaves the library through Governance so the organization knows what was provided.
3. Preserve the submitted set. The exact package submitted is retained in the audit view, including date and submitter.
4. Do not alter evidence to satisfy a request. If the evidence is weak, record the weakness. Manufacturing better-looking evidence is a governance failure.
5. Escalate ambiguous or broad requests. Requests with unclear scope or excessive breadth are clarified before production.

Do Not Feed the Audit Monster

Auditors and assessors need evidence, not a data dump. Over-sharing wastes time, creates contradictions, and invites questions that were never in scope. CERG responds precisely: the requested control, the requested period, the requested population, the evidence that proves it, and nothing theatrical. Discipline in evidence production is a security control and a legal hygiene practice.

8. Findings and Corrective Actions

Audit findings, control-test deficiencies, rejected evidence, and repeated evidence misses are tracked to closure.

A corrective action records owner, due date, remediation plan, verification method, and closure evidence. Closure requires evidence that the condition was corrected, not merely a statement that it was.

8.1 Plan of Action and Milestones (POA&M)

A Plan of Action and Milestones (POA&M) is the formal artifact for tracking and resolving control deficiencies, particularly those affecting CMMC assessment posture. POA&M requirements derive from NIST 800-171 and CMMC assessment guidance.

When a POA&M Is Required

A POA&M entry is required for:

• Any CMMC assessment finding (regardless of score impact)
• Any control rated “Deficient” in a control test affecting a CUI environment
• Any control gap identified during a formal CMMC assessment, self-assessment, or pre-assessment
• Any finding from a regulator, customer, or internal audit that maps to a CMMC practice
• Significant findings (Critical or High) in non-CMMC environments, at the CISO’s direction

POA&M Required Fields

POA&M Tracking and Status Updates

• POA&M entries are reviewed monthly by the CMMC / Federal Compliance Manager
• Status updates are recorded in the POA&M at each milestone or at minimum quarterly
• Overdue milestones are escalated to the Governance Pillar Leader
• The CISO reviews the full POA&M at the quarterly CISO-level risk review

POA&M Closure Criteria

A POA&M entry may be closed when:

1. The deficiency has been remediated and closure evidence is on file, OR
2. The deficiency has been formally risk-accepted through CERG-PRC-RM-001 with CISO approval, OR
3. The affected system has been decommissioned and the deficiency is no longer applicable

Closure requires sign-off by the CMMC / Federal Compliance Manager and the Governance Pillar Leader. Closure evidence is retained in the evidence library per Section 4.3.

9. Metrics

Audit and evidence metrics are reported through CERG-GOV-MTR-001.

10. Roles and Responsibilities

Roles below are canonical role names from CERG-GOV-OM-001 §6.1.

11. Regulatory and Framework Alignment Summary

12. Document Control

Revision History

Review Triggers

• Major audit, assessor, regulator, or customer evidence feedback
• Significant evidence rejection or repeated finding
• Change to CERG operational packages or control baseline
• New framework or regulatory evidence obligation
• Direction from the CISO

Cyber Governance owns this document. The Governance Pillar Leader is responsible for initiating reviews, managing the revision cycle, and obtaining CISO approval for all changes.

Related Documents

Source: procedures/CERG-PRC-AUD-001_Audit_and_Evidence_Management_Procedure.md · Download .md · View on GitHub