Index

Overview

Effective Evidence Management is a crucial component of the Security Questionnaire Automation platform. It provides a centralized system for storing, organizing, linking, and managing all supporting documentation (e.g., policies, procedures, audit reports, certifications, screenshots) that substantiates your answers to security questionnaires.

Having a robust evidence management system ensures that your responses are credible, auditable, and readily supported by factual documentation. This guide explains how to use the Evidence Management features to streamline your questionnaire workflow.

Key Features

Centralized Evidence Repository

• Secure Storage: Store all security-related documents and evidence in one accessible location.

• Organized Structure: Use folders, tags, categories, or other metadata to organize evidence logically.

• Version Control: Manage different versions of documents, ensuring that responses are linked to the correct version.

• Access Control: Define permissions for who can upload, view, edit, and manage evidence.

Evidence Linking

• Direct Association: Link specific pieces of evidence directly to individual questionnaire answers or controls.

• Many-to-Many Relationships: A single piece of evidence can support multiple answers, and a single answer can be supported by multiple pieces of evidence.

• Contextual Relevance: Ensure that linked evidence is directly relevant to the assertion made in the response.

Evidence Lifecycle Management

• Review and Approval: Implement a workflow for reviewing and approving evidence before it's used to support responses.

• Expiration Tracking: Set reminders for evidence that has an expiration date (e.g., certifications, annual reports) to ensure it remains current.

• Archival: Securely archive outdated or superseded evidence while maintaining historical linkage if needed for past submissions.

Search and Retrieval

• Powerful Search: Quickly find relevant evidence using keywords, tags, document names, or other metadata.

• Filtering: Narrow down evidence lists based on various criteria (e.g., type, status, associated control).

Integration with AI and Response Automation

• AI-Suggested Evidence: The AI may suggest relevant evidence from the repository to support generated answers.

• Automated Packaging: When exporting a completed questionnaire, the system can automatically bundle all linked evidence.

Getting Started

To effectively manage evidence:

1. Populate the Repository: Upload all relevant security documentation into the evidence library.

   • Organize documents using a consistent folder structure or tagging system.

   • Ensure document titles and metadata are descriptive.

2. Link Evidence to Knowledge Base/Controls (Proactive): If your platform supports it, proactively link pieces of evidence to standard answers in your knowledge base or to specific controls in your control library. This speeds up future questionnaire responses.

3. Responding to a Questionnaire: As you answer each question (manually or with AI assistance):

   • Identify the necessary supporting evidence.

   • Search the repository for the relevant document(s).

   • Link the selected evidence directly to the question's answer.

   • If the evidence doesn't exist, upload it to the repository and then link it.

4. Review Linked Evidence: Before submitting a questionnaire, review all linked evidence to ensure it is:

   • Relevant: Directly supports the answer.

   • Current: Not outdated or superseded.

   • Appropriate: Suitable for sharing with the recipient of the questionnaire.

5. Manage Evidence Lifecycle: Regularly review your evidence repository.

   • Update documents as your policies and procedures change.

   • Archive old evidence that is no longer relevant for current assessments.

   • Monitor expiration dates for time-sensitive documents.

Best Practices

• Be Granular but Sensible: Link the most specific piece of evidence possible. For example, instead of linking an entire 100-page policy document, link to the specific section or page if the platform allows, or create an excerpt.

• Consistent Naming Conventions: Use clear and consistent names for documents and evidence items.

• Tagging and Categorization: Utilize metadata features to make evidence easy to find and manage.

• Regular Audits: Periodically review your evidence repository for accuracy, completeness, and currency.

• Access Control: Restrict access to sensitive evidence based on roles and responsibilities.

• Version Control is Key: Ensure you are linking to the correct and current version of any document.

• Don't Over-Share: Only link evidence that is directly pertinent to the question. Avoid attaching overly broad or sensitive documents if a more specific piece of evidence will suffice.

Troubleshooting

Cannot Find Evidence

• Check Search Terms: Try different keywords or search filters.

• Verify Organization: Ensure the evidence is stored in the expected location or with the correct tags.

• Permissions: You may not have permission to view certain evidence.

Linking Incorrect Evidence

• Review Process: Implement a thorough review step to catch incorrect linkages before submission.

• Clearer Descriptions: Improve descriptions of evidence items in the repository.

Outdated Evidence

• Lifecycle Management: Proactively track review and expiration dates for all evidence.

• Notification System: Set up reminders for updating time-sensitive documents.

Getting Support

If you encounter issues with Evidence Management:

1. Consult the platform's help documentation.

2. Contact your system administrator or the AskInfosec support team.

Conclusion

Robust Evidence Management is fundamental to a trustworthy and efficient security questionnaire response process. By centralizing, organizing, and intelligently linking your supporting documentation, you can significantly enhance the credibility of your responses, save time, and ensure consistency. A well-maintained evidence repository is a valuable asset that supports not only questionnaire automation but also broader compliance and audit activities.