ASR-03 · Assurance and Evidence
Evidence is dated, attributable and retained
Evidence shows what was done, by whom and when, and is kept for the period the obligation requires.
7frameworks fully address it
1partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC4.1
- ISO 27001Full7.5
- NIST CSFPartialGV.OV-03 Through performance review.
- PCI DSSFull12.10.7
- HIPAAFull164.316(b)
- GDPRFullArt. 5(2)
- EU AI ActFullArt. 18
- NIST AI RMFFullGOVERN 1.4
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Evidence index, retention schedule, storage controls.
?Why it exists
Evidence without a date is an assertion.
For a smaller organizationA folder per control with dated files.