“We have a cybersecurity policy.” That is a good start. But in a compliance process, a second question immediately follows: can you demonstrate that it is actually being applied? This is where evidence becomes essential.
An assessment is not only intended to verify what the organization says it plans to do. It also seeks to determine what is actually happening in its systems and operations.
A Policy Alone Is Not Sufficient Evidence
Take account management as an example. A company procedure may state that an employee’s access must be removed when the employee leaves the organization. The assessor may review the procedure, but may also request a list of active accounts, recent examples of disabled accounts, and records showing that the process actually worked.
The same logic applies to many areas. If the company states that it performs backups, it may need to provide backup logs and test results. If it states that permissions are reviewed, it must be able to demonstrate that those reviews took place. If it states that incidents are handled, tickets, reports, and corrective actions become valuable evidence.
Examine, Interview, and Test
In its ITSP.10.171-01 assessment document, the Canadian Centre for Cyber Security describes three main methods used to assess security measures: examine, interview, and test.
Examination covers documents and mechanisms: policies, procedures, plans, configurations, access lists, logs, reports, architecture, and other records. Interviews help determine whether the people responsible truly understand the processes. Testing is used to determine whether a mechanism works as intended.
A perfectly written procedure that employees do not know about reveals one weakness. Highly capable software that is poorly configured reveals another.
Logs: An Essential Category of Evidence
Logs play a central role because they make it possible to reconstruct events. The standard provides, in particular, that relevant records should be able to indicate what occurred, when and where it occurred, the source, the outcome, and the associated identity.
Logs must also be protected against unauthorized modification or deletion. Once again, simply accumulating gigabytes of logs is not enough.
The company must determine what it wants to record, how long the data should be retained, and how significant events will be reviewed.
Approvals and Operational Histories
Evidence is not produced only by the security team.
A management system can also show that a purchase order was approved by the appropriate manager, that a user had the correct role, that a document was modified, or that a request moved through different approval stages.
This is where a traceable ERP can become particularly useful.
Instead of searching for confirmations in email threads, certain process steps can be recorded directly in the tool used to perform the work.
Periodic Reviews
Compliance is not an annual event. Some of the strongest evidence is precisely the evidence that demonstrates repeated activity: periodic account reviews, privilege reviews, log reviews, vulnerability tracking, or backup verification.
A control calendar helps prevent these tasks from being forgotten.
It also makes assessments easier because evidence is created progressively rather than reconstructed in a rush.
This approach echoes TechNuCom’s experience with SOC 2 Type 2: what gives a compliance program value is not merely the existence of a control, but its ability to operate and be demonstrated over time.
Organize Evidence Before You Need It
An SMB can greatly simplify its work by associating each control with a few basic elements: an owner, the expected evidence, the frequency, where the evidence will be stored, and the applicable procedure.
This way, the organization does not begin preparing for an assessment only a few weeks before the deadline.
Instead, it turns its day-to-day operations into a source of evidence. And that is probably the most important difference between “having good practices” and actually being ready to demonstrate them.