Glossary
Evidence pack
An evidence pack is a bundle of files that together show what was reviewed, who decided what, and what the systems held at the time.
What goes in one
“Evidence pack” is not a standard term. Auditors ask for evidence, and a pack is a tidy way to hand it over. A good one holds the list that was reviewed, with its date and the system it came from; who the reviewers were; each decision with its note and time; and the record that rejected access was removed. It also says what was in scope, so the reader can see whether the list was the whole population. What an auditor accepts is for the auditor to decide, so ask yours what they want to see.
Why it matters
Reviews are often done well and documented badly. The list sits in a spreadsheet, the decisions in email, the removals in tickets. When the auditor asks, someone spends days putting it together, and parts are missing. Building the pack as the review goes removes that work. The guide to the whole process says where it fits.
How Acciew uses the term
In Acciew, an evidence pack is a zip file built for one finished review. It holds a register (a spreadsheet with a row for every access, its decisions and their history), a report in PDF and Word, the logs of what was collected and of what was done, copies of what was collected, and a manifest that lists every file with its SHA-256 fingerprint. Acciew is in early access.
The pack is not signed. You check it with acciew-verify pack, an open-source program that reads the files and writes nothing, or with sha256sum -c manifest.sha256. A pass means the files agree with each other. It does not show that Acciew made the pack, that a collection was complete or true, or when anything was made. See hash chain for how the logs are checked.
Common mistakes
- Putting the pack together after the fact from screenshots.
- A list that is not the whole population.
- Decisions kept in email, outside the pack.
- Leaving out the removal. A pack that shows a rejection and no removal shows an open problem.
- Treating the pack as a certificate. It is what you hand to the person who decides.