ASR-03Assurance and Evidence
Evidence is dated, attributable and retained
Evidence shows what was done, by whom and when, and is kept for the period the obligation requires.
Why it exists
Evidence without a date is an assertion.
What usually proves it
Evidence index, retention schedule, storage controls.
Smaller organizations
A folder per control with dated files.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC4.1
- Fully addressedISO/IEC 27001 Annex A · 7.5
- Partially addressedNIST Cybersecurity Framework · GV.OV-03 — Through performance review.
- Fully addressedPCI DSS · 12.10.7
- Fully addressedHIPAA Security Rule · 164.316(b)
- Fully addressedGDPR · Art. 5(2)
- Fully addressedEU AI Act · Art. 18
- Fully addressedNIST AI Risk Management Framework · GOVERN 1.4