The unit of proof
A requirement like "enforce MFA" decomposes into objectives: is MFA implemented for this access class, for that one, for privileged accounts, with which authenticator types. An assessor works the objective list, not the requirement title — so an evidence library indexed by objective answers questions at the speed they're asked. A library organized as "the MFA folder" answers nothing until someone spelunks it.
Three methods, three artifact types
| Method | What the assessor does | What your evidence must be |
|---|---|---|
| EXAMINE | Reviews documents, configurations, records | Exported policy sets, configuration screenshots with visible dates and tenant context, logs, registers |
| INTERVIEW | Questions the people who operate the control | Named control owners who can narrate the process without reading the SSP — continuity of people is continuity of evidence |
| TEST | Exercises the mechanism to observe behavior | Demonstrable enforcement: the blocked login, the denied egress, the quarantined file — reproducible on demand |
Remapping Rev. 2 evidence
- Most artifacts survive; their index doesn't. A Conditional Access export that evidenced a Rev. 2 objective usually evidences the corresponding Rev. 3 objective — after deliberate re-indexing through the crosswalk, not by folder rename.
- Consolidated requirements concentrate evidence. Where Rev. 3 merged Rev. 2 requirements, the merged objective set still expects each parent's proof. Map many-to-one, drop nothing.
- ODP-touched objectives need value-aware evidence. If the parameter says weekly review, the evidence must show weekly — a generic "reviews happen" artifact stops being sufficient. Pair every such artifact with its register row.
- New-family objectives need new evidence. SCRM plans, acquisition security records, and planning artifacts have no Rev. 2 ancestors. Budget collection time, not just mapping time.
Refresh cadence beats heroic collection
Evidence ages. The sustainable model is a rolling refresh calendar — each objective's artifacts re-captured on a defined cadence as an operational byproduct — rather than a heroic collection sprint before each assessment. That calendar is precisely what managed compliance operates.
Evidence remapping is a fixed deliverable of the transition.
Your Rev. 2 artifact library re-indexed to 800-171A Rev. 3 objectives, gaps identified, refresh calendar installed. Or email rj@indirectit.com directly.