EvidenceSheet

SI-22 Information Diversity. Identify the following alternative sources of information for [organization-defined]: [organization-defined] ; and Use an alternative information source for the execution of essential functions or services on [organization-defined] when the primary source of

Information Diversity. Identify the following alternative sources of information for [organization-defined]: [organization-defined] ; and Use an alternative information source for the execution of essential functions or .

5
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

  • Evidence the alternative source is genuinely independent of the primary in origin and supply · Document repository
  • Records of use of an alternative source when the primary was compromised or unavailable · Document repository
  • Assessment of the alternative source's accuracy and timeliness relative to the primary · Document repository

governing documentDocuments that govern the control

  • The defined essential functions or services in scope and the alternative information sources identified for each · Policy repository / GRC workspace
  • The defined circumstances under which the alternative source is used · Document repository

First move

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

SI-21 Information Refresh. Refresh [organization-defined] at [organization-defined] or generate the information on demand and delete the information when no longer needed · SI-23 Information Fragmentation. Based on [organization-defined]: Fragment the following information: [organization-defined] ; and Distribute the fragmented information across the following systems or system components: [organization-defined]