Client collection pack
Evidence Checklist
A client-facing collection view that explains what to upload, what good proof looks like, and how assessor review states work.
- Purpose
- Evidence collection guidance
- Audience
- Client contributors
- Assessment
- Cybersecurity readiness
- Status
- Sample
Upload These First
| Priority | Evidence | What good looks like |
|---|---|---|
| High | Vulnerability remediation SLA tracker | Severity, owner, due date, remediation date, and closure evidence |
| High | MFA policy and platform export | Policy statement plus actual enforcement coverage from named identity and VPN tools |
| Medium | Incident response tabletop tracker | Actions, owners, status, due dates, and completion proof |
| Medium | Information security policy | Approved version, owner, review date, and scope |
Evidence Quality Rules
- Upload current evidence, not screenshots with missing dates.
- Include owner and approval context where possible.
- Evidence should prove operation, not only policy intent.
- If a questionnaire answer names Entra ID, Okta, FortiGate, or GlobalProtect, provide proof from that named platform.
- If evidence is rejected, upload a corrected version against the same request.
Assessor Review Signals
| Signal | Meaning |
|---|---|
| Accepted | Evidence is sufficient for the current assessment purpose |
| Under review | Assessor or AI-assisted review is still in progress |
| Rejected | Evidence is missing, stale, incomplete, or does not support the claim |
| Requested | Evidence has not been uploaded yet |
Why This Matters
The assessment is only as defensible as the evidence behind it. P86-Assess keeps the evidence request, uploaded file, hash, review decision, finding, and report output connected.