Distinguish control design, operation, and evidence so security claims can be verified.
The move: ask what would prove this control ran. Policy Policy states intent. It is necessary, but it does not prove execution. Design Design shows the control mechanism: who owns it, which systems it covers, what rule it enforces, and what exception path exists. Operation Operation shows the control ran for the relevant period and population. For access review, that means the users, systems, reviewers, dates, decisions, and removals. Evidence Evidence is the artifact a skeptical reviewer can inspect without trusting your memory. Screenshots can help, but exports, logs, tickets, attestations, and sampled records are usually stronger.
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in