Control-to-evidence

Connect narrowly scoped technical tests to control objectives.

What the baseline contains

15 structured records from P04_Control_Evidence. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

Root MFA and root access-key checks consume a timestamped AWS IAM account summary. Separate dependency-alert checks use their own vulnerability mappings.

Inspect the engineering

engine/ingest.py in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

Two technical tests do not demonstrate full SOC 2 or ISO 27001 coverage. Missing evidence produces unknown; observations older than 24 hours become stale.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.