A screenshot of a configuration screen proves that a setting was correct on the day somebody took a screenshot. It is accepted more often than it should be, and it falls apart at the first follow-up question: was it correct in March, is it correct across every environment, and what would have told you if it had changed?
Three Properties Worth Insisting On
Provenance: the evidence says where it came from and when, without relying on somebody remembering. A file named 'final_v3' has none.
Coverage: it is clear what population the evidence describes and how the sample was chosen. One passing example from an unknown set proves the example.
Continuity: it speaks to a period, not an instant. A control operating over a quarter should be evidenced over a quarter.
Why This Is Not Pedantry
Weak evidence costs more than it appears to, in two ways. It expands the audit, because an assessor who cannot rely on one artefact will sample harder everywhere. And it hides real failures: an organization collecting only point-in-time proof has no way of knowing whether a control lapsed between collections, so it finds out when something goes wrong rather than when the control drifted.
There is also a compounding benefit. Evidence with provenance and coverage can be reused — the same artefact serving an internal audit, a customer's due diligence and a regulatory response — while a screenshot generally has to be recreated for each audience.
“Evidence is not the proof that you passed. It is the record that lets someone else reach the same conclusion you did, without taking your word for it.”
Starting Where It Matters
Rebuilding an evidence base wholesale is rarely realistic. The practical route is to identify the small number of controls that carry the most regulatory or contractual weight, fix the evidence for those first, and let the rest improve as each control comes round in the review cycle. The measure of progress is simple enough to apply: for each control, could you answer 'how do you know?' twice before running out of record?
