A security evidence register is a simple table listing every piece of evidence you use to support a customer answer. Keep eight columns: control, claim, artefact link, source, owner, capture date, expiry or review date, and approver. With those fields, any answer can be traced to proof in minutes.
Why a register beats a folder
A folder holds files. A register holds meaning: which claim a file supports, who vouches for it and when it stops being reliable. During a customer review, that difference decides whether you answer in a minute or in a week.
The eight columns
| Column | What goes in it | Why |
|---|---|---|
| Control | The control area, such as access review | Groups evidence by topic |
| Claim | The sentence in your answers it supports | Links proof to words |
| Artefact | Link to the file or export | Retrieval |
| Source | The system it came from | Reviewers ask how it was produced |
| Owner | A role and a named person | Someone is accountable |
| Captured | Date the artefact was created | Freshness |
| Review by | Date it must be refreshed | Prevents staleness |
| Approver | Who confirmed it can be shared | Controls disclosure |
Optional extras include sensitivity level, whether an NDA is needed, and the customers it was shared with.
Set it up in an afternoon
- Create the table in a shared sheet with limited edit rights.
- List your top twenty claims from the answer library.
- For each, find the single best artefact. If none exists, mark it as a gap.
- Fill source, owner and dates honestly. An old date is better than a guessed one.
- Set review dates by type: quick moving items such as access lists sooner, policies yearly.
- Add a filter for items due within thirty days.
Rules for entries
- Link to the original in a controlled store, not a copy on someone's desktop.
- Record the capture date from the system, not the date you remembered to save it.
- Never replace an old artefact; add the new one and keep the old for history.
- One claim may have several artefacts, but name the primary one.
Monthly review
Spend fifteen minutes. Sort by review date, refresh anything due, and chase owners for overdue items. Count entries with no artefact and report that number to the accountable executive. Over time, the number of gaps should fall.
Reading across frameworks
The same artefact often supports more than one framework or questionnaire. Tag each entry with the frameworks it helps. That lets you answer a new form by searching the register instead of starting from scratch, and shows which pieces of evidence do the most work.
Typical mistakes
A register that is complete on day one and untouched afterwards is worse than a short one that is kept current, because it gives false confidence. Start small, keep it alive, and grow it as you answer more questions.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one item of evidence can support several requirements, which is the reason to tag it.
Where Safeguard fits
Safeguard's compliance and evidence automation can capture dated records and link them to controls so the register fills itself where tools allow, and the free scan at https://gold.safeguard.sh/scan gives a quick dated result for the software side.
Quick check
Do we need special software for a register?
No. A shared spreadsheet works if someone owns it and reviews it monthly.
What if an artefact has no source system?
Record how it was produced and by whom, and mark it as manual so reviewers know.
Last reviewed: 19 October 2026.
