What you show an assessor to prove a requirement is met. It must be final, not draft, and it must match what your plan claims.
Also called assessment evidence, artifacts.
Practitioner Guidance
What it means in practice
Evidence must be in final form, and draft material is explicitly rejected.
Section 170.24(b)(1) says all evidence must be final and not draft, and it names working papers, drafts, and unofficial or unapproved policies as unacceptable. A policy waiting for a signature is not evidence. Approve your documents before the assessment, because this is one of the easiest findings to avoid and one of the most common to receive.
Evidence comes in three shapes, and they match how an objective is tested.
Documents are examined. People are interviewed. Systems are tested. A policy proves what you decided. A configuration export or a screenshot proves what is running. A person answering consistently proves the process is real. Most assessment objectives need at least two of the three, because a document alone does not show the control operates.
An assessor tests your claims, so the evidence has to match your plan.
Everything starts from your system security plan. If the plan says access reviews happen quarterly, the evidence is four reviews. If it says a provider performs a control, the evidence is the provider's record. A plan that promises more than you do creates findings that would not otherwise exist.
Records that accumulate over time cannot be produced on request.
Audit log reviews, training completions, access reviews, incident tickets, and vulnerability scan results are evidence of a practice running. They are the hardest evidence to create late, because their value is in the dates. CA.L2-3.12.1 asks you to assess your controls periodically, and those records are the proof. Start producing them months before the assessment, and keep them where you can find them.
What falls short
A policy document with no approval date or approver. Unapproved policies are named as unacceptable evidence.
A screenshot with no date, system, or context. The assessor has to know what was shown and when.
Evidence collected the week of the assessment for a control claimed to have run all year. The dates tell the story.
Edge cases
A control is inherited from a provider. The provider's report or matrix is your evidence, and you hold it rather than pointing at a website.
An objective is satisfied by something that leaves no record. Create one, because an unrecorded practice is very hard to assess.
Evidence contains controlled information. Handle it inside your assessed environment, and prepare a way to show it without moving it outside.
Over-engineering
A compliance platform bought to store evidence for a small company. A structured folder and a written index do the same work.
Collecting every log and document you can produce. Volume slows the assessment, and the assessor works from objectives.