Evidence and assurance case management procedure

Evidence and assurance case management procedure

EV-01 — Evidence policy

[Organisation] retains evidence sufficient to support the decisions and assurance claims it makes about the SSDLC and its systems. Evidence records identify what was observed or produced, its source, applicable scope and the claim it supports. The custodian preserves relevant context so that another person can understand the record without reconstructing the entire project history.

Evidence may include requirements, decisions, configuration, source and build records, test results, observations, supplier reports, communications and assessment findings. The type and amount retained are selected according to the promise, risk and applicable obligations. Keeping every available record is not assumed to improve assurance if the relevant evidence cannot be identified or interpreted.

EV-02 — Capture provenance and context

Each evidence item has an identifier, creator or source, capture date and time where relevant, system or configuration scope, version and repository location. Records of execution identify the method, inputs, environment and actual outcome. Records received from suppliers identify the provider, coverage period, scope and restrictions on use or disclosure.

The custodian distinguishes original records, copies, extracts and transformations. An extract states what was omitted and preserves a reference to the source where retained. Summaries identify their author and the underlying evidence. A machine-generated explanation of a result is not substituted for the result without recording that the original evidence is unavailable.

EV-03 — Protect and retain

Access, integrity and retention controls are selected for the evidence’s sensitivity and significance. The repository records authorised changes and preserves versions needed to interpret earlier decisions. Integrity mechanisms such as hashes, signatures or protected logs are used where selected, with the associated verification information and trust assumptions retained.

The retention schedule identifies the purpose, period, trigger, custodian and disposal method. Preservation holds are recorded and reviewed. Evidence containing personal information, secrets or sensitive vulnerability details is handled under the information policy. Where broad access is useful but the source is sensitive, the custodian can provide a controlled summary or redacted copy while preserving the relationship to the original.

EV-04 — Build an assurance argument

The assurance owner records the claim being made about the system, the context in which it applies and the stakeholders relying on it. The argument explains why the available evidence supports that claim. Large claims are decomposed into more specific claims about requirements, design, implementation, operation or response, with their dependencies identified.

The owner records assumptions, limitations and conditions that could defeat the argument. These may include untested operating states, supplier visibility limits, common failure sources or evidence that does not cover the current configuration. Counter-evidence is preserved and addressed. A collection of test reports without an explanation of the supported claim is an evidence collection, not a complete assurance argument.

EV-05 — Evaluate strength and independence

The assessor considers relevance, completeness, authenticity, currency and independence in relation to the claim. A record can be authentic but irrelevant to the current version, or current but incomplete for the operating population. Several reports based on the same underlying test are identified as shared evidence rather than counted as independent confirmation.

The assessment distinguishes evidence that an activity was planned, evidence that it occurred and evidence that it achieved the intended outcome. A signed policy proves approval of a promise; it does not establish performance. An artefact hash identifies content; it does not establish that the content is correct. A running service provides evidence about that service state, not automatically about an unbuilt source revision.

EV-06 — Maintain currency

The owner records the changes or dates that require evidence to be reviewed. Relevant triggers include changes to requirements, system configuration, model behaviour, suppliers, operating conditions, assessment methods and threat assumptions. The owner identifies which claims depend on the affected evidence and whether they remain supportable.

Superseded evidence remains associated with the decisions it supported, while the current record identifies its limited applicability. A new assessment does not overwrite the historical result. The assurance package states the configuration and period covered and identifies claims requiring renewed evidence. Unavailable historical material is recorded as a limitation rather than reconstructed as if it were an original record.

Assurance argument record: [Claim ID; owner; intended decision]
Claim: [Specific property or outcome asserted]
Context: [System version; scope; operating conditions; stakeholders]
Reasoning: [Why the evidence supports the claim]
Supporting claims and evidence: [IDs and relationships]
Assumptions and counter-evidence: [Conditions; challenges; response]
Limitations: [Unassessed states; missing evidence; common dependencies]
Decision and maintenance: [Reviewer; conclusion; date; change triggers]

EV-07 — Evidence assurance

The reviewer samples claims and checks whether the referenced evidence can be retrieved and interpreted. The reviewer follows selected evidence items to their source and confirms the applicable configuration and handling history. Findings identify broken links, unexplained transformations, expired reliance, missing context and claims broader than their evidence. Corrective actions improve the record or narrow the claim through an accountable decision.