A control is something you do to reduce risk. Evidence is proof that you did it. An artifact is a single record that serves as that proof, such as a review log. NIST's SSDF defines an artifact as "a piece of evidence". Auditors test controls by examining evidence.
Three words, three jobs
| Term | Meaning | Example |
|---|---|---|
| Control | A rule or action that reduces risk | Every change gets a second reviewer |
| Evidence | Grounds to believe the control works | A set of reviewed changes |
| Artifact | One record of the practice | A single pull request with reviewer and date |
SP 800-218 version 1.1 defines an artifact as a piece of evidence and says artifacts provide records of secure software development practices. Evidence, in the cited NIST wording, is grounds for belief or disbelief.
A worked example: code review
The control: changes need approval from someone other than the author.
The artifacts: pull requests with the reviewer name, timestamp and approval.
The evidence: a sample of those pull requests across the audit period, plus the repository rule that enforces it.
Ask three questions of any item you plan to show:
- Which control does it support?
- Does it show the control operated, or only that it exists?
- Can someone else check it without trusting me?
Why the difference matters
Teams often hand over policies and call them evidence. A policy shows intent. The SSDF examples lean on records from tools, such as an audit trail built from workflow and issue tracking, and ask for retention rules and protection of that data.
Good evidence habits
- Prefer system generated records with timestamps and identity
- Keep one folder per control with a short note on what each file shows
- Record how the sample was chosen
- Keep records unchanged once collected
A quick test before you submit anything
Imagine you are the auditor with no context. Open the file you plan to hand over. Can you tell what it is, which system produced it, when, and which control it relates to? If the answer needs a conversation, add a one line note or rename it. Evidence that explains itself saves a round of follow up questions, and follow ups are where audits slow down.
Quick check
Is a policy document evidence?
It is evidence that a rule exists. It does not show the rule was followed, so pair it with operating records.
How many artifacts make enough evidence?
There is no fixed number. Auditors usually sample, so records must be consistent across the whole period.
Where tooling helps
Safeguard offers compliance and evidence automation, which keeps dated records against controls, and policy gates that create them on pull requests. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
