Evidence register

The evidence register is the index of your whole compliance program: one row per control, pointing at the artifact that proves it. When an auditor sends a PBC (Provided By Client) list or a buyer sends a security questionnaire, you answer from this table instead of starting a scavenger hunt.

Keep it in your private evidence repo next to the populated evidence-folder-template/. The controls-map.md tells you what evidence each control needs; this register tracks the actual artifacts you have and their freshness.

Don't use this register as a disclosure log. It answers "what evidence do we hold, and is it current?" — not "who did we send it to, and has their access expired?" Those are different questions with different review cadences, and jamming both into one sheet makes each harder to answer. When an artifact leaves the company, record it in the evidence-sharing-log.md and sanitize it first per safe-evidence-sharing.md.

Columns

Status rule of thumb: mark a row stale once last_refreshed is older than its cadence window. A quick way to spot the backlog before an auditor does is to sort by status.

Example (fictional Series B SaaS)

CSV version

If you'd rather track this in a spreadsheet or pipe it into a script, the same schema as CSV — copy this into evidence-register.csv:

All 30 controls from controls-map.md are listed here, so nothing is silently omitted.

control,system,owner,artifact,source,cadence,last_refreshed,status
1.1 MFA enforcement,Google Workspace,,01-access-controls/mfa-enforcement.md,Admin > Security > 2-step verification,Quarterly,,missing
1.2 Least-privilege IAM roles,,,01-access-controls/iam-quarterly-review.md,,Quarterly,,missing
1.3 Service-account / key inventory,,,01-access-controls/iam-quarterly-review.md,,Quarterly,,missing
1.4 Offboarding access revocation,,,01-access-controls/offboarding-checklist.md,,Per offboarding,,missing
1.5 Privileged access review,,,01-access-controls/privileged-access-review.md,,Quarterly,,missing
2.1 Cloud audit logging enabled,,,02-logging-monitoring/audit-log-config.md,,Quarterly,,missing
2.2 Audit log retention >= 365 days,,,02-logging-monitoring/retention-policy.md,,Annually,,missing
2.3 Application logs centralized,,,02-logging-monitoring/app-logging.md,,Annually,,missing
2.4 Alert routing to on-call,,,02-logging-monitoring/alert-routing.md,,Annually,,missing
2.5 Tamper-resistant log storage,,,02-logging-monitoring/log-immutability.md,,Annually,,missing
3.1 Peer review before merge,,,03-cicd-change-management/branch-protection.md,,Quarterly,,missing
3.2 Environment-protected deploys,,,03-cicd-change-management/deploy-approvals.md,,Quarterly,,missing
3.3 Signed / verified deploy artifacts,,,03-cicd-change-management/artifact-signing.md,,Quarterly,,missing
3.4 Release evidence,,,03-cicd-change-management/release-evidence.md,,Per deploy / quarterly,,missing
3.5 Rollback capability documented,,,03-cicd-change-management/rollback-runbook.md,,Annually,,missing
4.1 Dependency scanning,,,04-vulnerability-secrets/dependency-scanning.md,,Quarterly,,missing
4.2 Image scanning,,,04-vulnerability-secrets/image-scanning.md,,Quarterly,,missing
4.3 Secret scanning,,,04-vulnerability-secrets/secret-scanning.md,,Quarterly,,missing
4.4 Static analysis (SAST),,,04-vulnerability-secrets/sast.md,,Quarterly,,missing
4.5 Pen-test within 12 months,,,04-vulnerability-secrets/pentest-summary.md,,Annually,,missing
5.1 Backup configuration,,,05-backups-recovery/backup-config.md,,Quarterly,,missing
5.2 Backup restore tested,,,05-backups-recovery/restore-test.md,,Quarterly,,missing
5.3 Incident runbook,,,05-backups-recovery/incident-runbook.md,,Annually,,missing
5.4 Status page / availability signal,,,05-backups-recovery/status-page.md,,Annually,,missing
6.1 Model endpoint auth,,,06-ai-workload-controls/endpoint-auth.md,,Quarterly,,missing
6.2 Prompt / tool-call logging,,,06-ai-workload-controls/prompt-tool-call-logging.md,,Annually,,missing
6.3 Per-tenant spend caps,,,06-ai-workload-controls/spend-caps.md,,Quarterly,,missing
6.4 RAG document access boundaries,,,06-ai-workload-controls/rag-access-boundaries.md,,Quarterly,,missing
6.5 AI data retention reviewed,,,06-ai-workload-controls/data-retention.md,,Annually,,missing
6.6 Abuse / misuse handling,,,06-ai-workload-controls/abuse-handling.md,,Annually,,missing

Fill in system, owner, source, and last_refreshed as you collect each artifact, and flip status to current. Rows that stay missing are your readiness backlog.