Evidence is anything that demonstrates a control is designed, implemented, and operating. That can be a signed policy, a configuration export, a training certificate, or a meeting minute — provided it is retrievable, dated, and traceable.

Structuring an evidence library

Organise by control or requirement (not by author or year). Link each artefact to the framework references it supports and the owner accountable for keeping it current.

Avoiding common failure modes

The three failures we see most often: stale artefacts, conflicting versions, and orphaned evidence (no owner). A simple quarterly review with named owners eliminates the majority.

Evidence Management for Aviation Cyber