EVA Evidence, Assessment and Assurance Management

The evidence lead shall maintain, for every in-scope control, an Evidence Requirement profile using the AIDCF-008 classes, quality dimensions (P, F, C, R, T, I), sufficiency levels and control profile tiers, strengthened where the capability profile or criticality requires and never weakened below the registry profile. The evidence lead shall maintain a mapping of every local evidence subtype (for example 'EPMS waveform capture', 'CDU trend export', 'fabric link error report') to exactly one AIDCF-008 class.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E2. Operating states: NORMAL.

The evidence lead shall assign, for each Evidence Requirement in an assessment, a source owner (person or role in the owner, operator or provider organisation) responsible for producing the evidence by the requested date, and shall record each request, response, delay and refusal in the evidence request record. Unfulfilled requests at the response deadline shall be escalated to the capability owner and recorded as UNKNOWN where unresolved.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The evidence lead shall operate an evidence repository in which every Evidence Object has an immutable identifier, the mandatory metadata defined in AIDCF-008 (including source, collector, custodian, observation time, collection time, scope, state, classification, integrity value and lifecycle state), and conditional metadata for test, telemetry, configuration, human, external and derived evidence. The tool owner shall configure the repository to generate an EvidenceManifest with content hashes for each Evidence Package and to freeze the manifest referenced by each Assurance Decision.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state. Optional: E7. Operating states: NORMAL.

The evidence lead shall assign each Evidence Object a retention class (R0-R5) and a classification level, define retention periods by legal, contractual and decision-validity requirements, apply legal holds when instructed, and record authorised destruction. The tool owner shall back up the repository, including manifests and custody logs, to a separate fault domain and shall test restoration at the restoration test interval, verifying hashes and custody logs after restore.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E5. Operating states: NORMAL, RECOVERY.

The lead assessor shall ensure that, before an Evidence Object is accepted, its source, collector, collection activity and authority are recorded and verified; that derived evidence records source Evidence IDs, query or script and version, assumptions and reviewer; and that AI-assisted extraction, summarisation or classification is recorded with model and version, process record and the accountable human review, and is treated as candidate evidence that does not corroborate its own sources.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E7 Derived and analytical. Optional: E2. Operating states: NORMAL.

The evidence lead shall ensure that every Evidence Object supporting a gate result or Assurance Decision has an integrity value computed at collection, an integrity level (I0-I5) assigned, and a custody log; that integrity values are re-verified before decision issue and on retrieval for challenge or reassessment; and that integrity failures are recorded, investigated and the affected evidence withdrawn from support. The evidence lead shall test detection at least once per integrity test interval by a controlled tamper exercise on test objects.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E1, E5. Operating states: NORMAL.

The lead assessor shall ensure that every Evidence Object used to support a Control Assessment is rated on all six AIDCF-008 quality dimensions with rationale, that the fitness (F) rating considers subject, criterion, claim type, configuration and operating state, that the reliability (R) rating considers method repeatability and corroboration, and that a second assessor independently re-rates a sample with differences resolved and recorded.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E6. Operating states: NORMAL.

The lead assessor shall ensure that each Evidence Object used to support a result is checked against the AIDCF-008 freshness basis for its category and against any material change since collection, and that each Control Assessment records coverage across entity, population, location, time, operating state, scenario, tenant or workload, and dependency dimensions, with gaps recorded as U3 or U5 UNKNOWN Records.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E7 Derived and analytical. Optional: E2. Operating states: NORMAL.

The decision authority shall approve, before fieldwork begins, a decision question for each assessment that states the Capability Instance, the Service Outcomes and tolerances in question, the operating states, the as-of date or period, the intended users and use, and the interpretations the conclusion shall not support. The lead assessor shall frame the assurance case top claim from the approved decision question and shall obtain re-approval if the question changes during the assessment.

Evidence required: E1 Documentary and declarative. Optional: E6. Operating states: NORMAL.

The lead assessor shall prepare, and the decision authority shall approve before fieldwork, a scope record for each assessment stating the boundary across physical, logical, organisational, provider and temporal dimensions; the operating states assessed; the applicable AIDCF artifact and capability-profile versions; the applicable controls with claim types; the applicable gates; and every exclusion with rationale and residual effect on the decision. The lead assessor shall reconcile the boundary to the ArchitectureSnapshot (MCF-CAP-004) and record any element of the snapshot that is neither in scope nor excluded.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E2. Operating states: NORMAL.

The lead assessor shall document, for each sample, the population and its frame, strata, selection method, sample size rationale, exclusions and expansion rule, and shall record failed samples and their effect. For each test, the lead assessor shall obtain written authorisation from the system owner and, for hazardous or service-affecting tests, the safety authority, and shall record the initial state, method, expected result, abort criteria, instrumentation, restoration steps, result and anomalies. Tests shall be performed by authorised operators; assessors shall observe.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E4 Validation and test. Optional: E6. Operating states: NORMAL, MAINTENANCE, DEGRADED.

The lead assessor shall identify, for each assessment, the domains requiring specialist judgement, appoint a competent specialist for each (MCF-GOV-023), and record the specialist's scope, competence evidence and responsibility. Each specialist shall approve the methods and the Control Assessment results in their domain. Where a specialist is external, the lead assessor shall evaluate their independence and the transferability of their conclusions.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The lead assessor shall record every Finding with a stable identifier, criterion (control and assessment criterion), condition, supporting and challenging Evidence Object references, cause where evidenced or labelled as analysis, consequence for Service Outcomes, dependencies and states, classification, and gate and score effect. The action owner shall record closure evidence, and the lead assessor shall close a Finding only after re-assessing that evidence.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E7 Derived and analytical. Operating states: NORMAL.

The lead assessor shall record every UNKNOWN as an UNKNOWN Record with subject, missing attribute, type (U1-U10), severity (US1-US5) with the test that determined it, reason, potential consequence, evidence needed, owner, status and gate and decision effect. The decision authority shall ensure that every US3, US4 and US5 UNKNOWN Record is reflected in the Gate Results, decision ceiling and report, and that UNKNOWN Records are closed only by new evidence or approved re-scoping, never by assumption.

Evidence required: E3 Operational and observational; E4 Validation and test; E7 Derived and analytical. Optional: E1. Operating states: NORMAL.

The lead assessor shall register each material evidence conflict as an EvidenceConflict with both assertions and their evidence lineages, analyse scope, time and state differences, seek corroboration, obtain competent review and record whether the conflict is resolved, bounded or escalated. Unresolved conflicts shall be recorded as U4 UNKNOWN Records; observed or tested evidence shall take precedence over design intent unless shown to be unrepresentative.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E2, E3. Operating states: NORMAL.

The lead assessor shall compile a limitations register for each assessment covering exclusions, restricted or inaccessible evidence, unassessed operating states, assumptions, sampling and test limits and reliance on providers or specialists, each with its effect on the decision. The reporting owner shall ensure every report and Assurance Statement for the assessment discloses each limitation with an effect on the decision, and that redaction for security does not remove a limitation.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Operating states: NORMAL.

The lead assessor shall determine, for each assessment, the applicability of each gate CG-01 to CG-15 to the decision question and boundary, shall identify for each applicable gate the in-scope CRITICAL and SUPPORTING controls from the AIDCF-007A registry gate mappings and the gate criteria from AIDCF-010, and shall submit any proposed APPROVED_NA with boundary rationale to the decision authority. Meta-gates CG-11 and CG-12 shall always be applicable.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Operating states: NORMAL.

The lead assessor shall assemble, for each applicable gate, a gate Evidence Package containing the mandatory evidence classes for that gate, shall assess its sufficiency against the gate floor, and shall compute the Gate Result by the AIDCF-010 roll-up rule from CRITICAL control results, gate criteria and evidence sufficiency. The independent reviewer shall confirm, for each gate, that no evidence below the mandatory type or quality floor was substituted.

Evidence required: E1 Documentary and declarative; E7 Derived and analytical. Optional: E5. Operating states: NORMAL.

The decision authority shall issue each Assurance Decision personally or through documented delegation, on the basis of a Decision Recommendation from the lead assessor and the independent review record, and shall record the decision state, controlling reasons (including Gate Results and UNKNOWN ceilings), conditions with owners and dates, and validity. The tool owner shall ensure that no tool can transition a decision to APPROVED without the decision authority's authenticated action.

Evidence required: E1 Documentary and declarative; E2 Configuration and technical state; E3 Operational and observational. Optional: E6. Operating states: NORMAL.

The reporting owner shall ensure that every report and Assurance Statement uses the controlled decision states (REASONABLY_ASSURED, CONDITIONALLY_ASSURED, LIMITED, NOT_ASSURED, INCONCLUSIVE), Gate Results (PASS, FAIL, UNKNOWN, APPROVED_NA, NOT_ASSESSED) and control results of AIDCF-010 with the controlled wording of AIDCF-012; bounds each conclusion by Capability Instance, Service Outcomes, boundary, operating states and as-of date; and contains no prohibited claim (certified, accredited, universally safe, secure or resilient, compliant with all laws). The independent reviewer shall check claim language before issue.

Evidence required: E1 Documentary and declarative; E3 Operational and observational. Optional: E7. Operating states: NORMAL.

The evidence lead shall record, for each Evidence Object supporting a current Assurance Decision, its currency basis and review date per AIDCF-008, shall monitor for expiry, and on expiry of mandatory evidence shall notify the lead assessor and capability owner, mark the evidence STALE and initiate review of the dependent claims and Gate Results within the expiry response time.

Evidence required: E2 Configuration and technical state; E3 Operational and observational. Optional: E1, E7. Operating states: NORMAL.

The assurance programme lead shall define reassessment triggers for each current Assurance Decision (material architecture, capacity, configuration, provider or ownership change; incidents affecting Service Outcomes; gate FAIL or critical UNKNOWN; evidence invalidation), shall connect the change, incident and evidence systems so that trigger events are routed to the lead assessor and capability owner, and shall verify at least once per trigger test interval, by injecting a test event, that triggers reach the responsible roles and initiate reassessment.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E4 Validation and test. Optional: E1, E7. Operating states: NORMAL, TRANSITION.

The assurance programme lead shall, for each claim under continuing assurance, define the monitored indicators, their source feeds, coverage across assets, locations and operating states, thresholds that trigger review, and known blind spots. The tool owner shall monitor feed health (gaps, latency, clock integrity, dropped data) and alert the evidence lead on degradation; the programme lead shall state blind spots in each continuing-assurance report.

Evidence required: E2 Configuration and technical state; E3 Operational and observational; E7 Derived and analytical. Optional: E1. Operating states: NORMAL, DEGRADED, MAINTENANCE.

The decision authority shall define criteria for suspension, withdrawal and supersession of Assurance Decisions, shall act on each trigger response that meets the criteria within the suspension time, shall notify all intended users and recipients of external communications, and shall preserve the prior decision, its evidence manifest and the reason for change. The programme lead shall rehearse the suspension and notification process at least once per rehearsal interval.

Evidence required: E1 Documentary and declarative; E3 Operational and observational; E4 Validation and test; E7 Derived and analytical. Optional: E6. Operating states: NORMAL, RECOVERY.