ASR-05Assurance and Evidence
Findings are closed with evidence
Findings carry an owner, a date, a remediation and evidence that the fix works.
Why it exists
A closed finding without evidence is an open finding with better paperwork.
What usually proves it
Findings register, remediation evidence, verification.
Smaller organizations
A tracker leadership reviews monthly.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC4.2
- Fully addressedISO/IEC 27001 Annex A · 10.1
- Fully addressedNIST Cybersecurity Framework · ID.IM-01
- Fully addressedPCI DSS · 12.11.2
- Partially addressedHIPAA Security Rule · 164.308(a)(1)(ii)(B) — Through risk management.
- Deliberately absentGDPR — No findings process defined.
- Partially addressedEU AI Act · Art. 20 — Corrective actions by providers.
- Fully addressedNIST AI Risk Management Framework · MANAGE 2.4