← Control library
E01 · Evidence
Evidence provenance and integrity
Screenshots or exports cannot be tied to the tested system, time or responsible collector.
Requirement
Label each artefact with origin, collector, timestamp, environment, version and integrity reference, while redacting unnecessary data.
Expected evidence
- Evidence register with chain of custody.
- Original artefacts or hashes in access-controlled storage.
Proposed verification
- Select artefacts and resolve them to source systems and tests.
- Check redaction did not remove facts needed for the conclusion.
Limit
Provenance supports authenticity, not the truth or completeness of the underlying event.