Evidence Collector Skill

Evidence Collector Skill

Plan and manage the collection of security evidence for compliance audits, continuous monitoring, and assessment activities.

When to Use This Skill

Use this skill when you need to:

• Identify evidence requirements for controls
• Create evidence collection plans
• Track evidence collection status
• Validate evidence completeness
• Prepare for compliance audits

---

⛔ Authoritative Data Requirement

Evidence requirements are derived from user-provided control baselines and SSPs.

What Requires Source Documents

What You CAN Provide (Methodology)

• General evidence types and categories
• Collection best practices
• Evidence package structure templates
• Frequency recommendations
• Quality assessment frameworks

Example: Safe vs Unsafe

✅ Safe: "For access control policies, typical evidence includes policy documents, approval records, and review logs."

⛔ Unsafe: "AC-2 requires you to collect user account listings monthly and maintain them for 3 years." (← Specific requirements must come from your baseline/​profile)

---

Evidence Types

Evidence Sources

Collection Status

How to Plan Evidence Collection

Step 1: Identify Control Requirements

For each control:

1. Read the control statement
2. Identify what must be demonstrated
3. List evidence that proves compliance

Step 2: Map Evidence to Controls

Step 3: Create Collection Plan

For each evidence item:

evidence_plan:
  control_id: AC-2
  evidence_type: configuration
  title: Active Directory User Listing
  description: Complete list of all user accounts
  collection_method: PowerShell export
  frequency: Monthly
  retention: 1 year
  responsible_party: IT Admin
  automated: true

Step 4: Define Collection Frequency

Evidence Requirements by Control Family

Access Control (AC)

• User account listings
• Access approval documentation
• Privilege reviews
• Access control policy

Audit (AU)

• Audit log samples (30+ days)
• Log retention settings
• Alert configurations
• Log review procedures

Configuration Management (CM)

• Baseline configurations
• Change management records
• Configuration scan results
• Inventory listings

Incident Response (IR)

• IR policy and procedures
• Incident tickets/​records
• Tabletop exercise results
• Communication plans

Evidence Package Structure

evidence/
├── AC-2/
│   ├── user_listing_2024-01.csv
│   ├── user_listing_2024-02.csv
│   └── access_review_Q1.pdf
├── AU-2/
│   ├── audit_logs_sample.json
│   └── siem_config.png
└── manifest.json

Evidence Manifest

{
  "package_id": "EVD-2024-001",
  "control_id": "AC-2",
  "collection_date": "2024-01-15",
  "items": [
    {
      "id": "EVD-001",
      "title": "User Account Listing",
      "file": "user_listing_2024-01.csv",
      "hash": "sha256:abc123...",
      "collector": "IT Admin",
      "status": "verified"
    }
  ],
  "completeness_score": 0.95,
  "gaps": ["Missing service accounts"]
}

Completeness Scoring

Calculate evidence completeness:

Completeness = (Verified Items / Required Items) × 100

Scores:

• 100%: Fully documented
• 80-99%: Minor gaps
• 60-79%: Significant gaps
• <60%: Major deficiencies

Audit Preparation Checklist

30 Days Before Audit

• Identify all required evidence
• Verify evidence is current
• Fill collection gaps
• Review evidence quality

7 Days Before Audit

• Organize evidence by control
• Create evidence index
• Verify access for auditors
• Brief responsible parties

Day of Audit

• Evidence accessible
• SMEs available
• Backup copies ready

Output Format

EVIDENCE COLLECTION STATUS
==========================
Control: AC-2 (Account Management)
Required Evidence: 5 items
Collected: 4 items (80%)

Evidence Items:
✅ User account listing (collected 2024-01-15)
✅ Account approval workflow (collected 2024-01-10)
✅ Quarterly access review (collected 2024-01-05)
✅ Termination checklist (collected 2024-01-12)
❌ Service account inventory (MISSING)

Gaps:
- Service account inventory not collected
  Recommendation: Export from AD, due by 2024-01-20

Example Usage

When asked "What evidence do I need for FedRAMP audit?":

1. Get baseline controls (Moderate = 325 controls)
2. For each control family, list evidence requirements
3. Identify automation opportunities
4. Create collection schedule
5. Assign responsible parties
6. Generate collection plan document