The Compliance Evidence Operating Model

What’s inside

1. The short version
2. The problem is design, not diligence
3. What assessors weigh when they look at evidence
4. Five design principles
5. Reference architecture
6. The evidence specification: the unit of design
7. Not all evidence is equal
8. A worked example: one control from specification to assessor
9. Four design decisions that shape everything else
10. Handling assessor requests
11. Roles and responsibilities
12. Failure modes to design out
13. Regulation sets what must be evidenced. The model decides how.
14. Choosing tooling
15. Building it in order
16. A test to run this week

Sources are listed in the full architecture guide.