What counts as evidence, and what is good enough
An answer of “yes” is a claim. Evidence is what shows the claim is true: a document, a setting, a record. This guide explains the levels ReversePath uses and what a reviewer looks for at each.
Five levels
| Level | What it means |
|---|---|
| Claimed | Answered as in place. Nothing attached shows it. |
| Documented | A written policy, procedure, notice or contract exists. |
| Implemented | Something shows it working: a screenshot of a setting, a log, a register. |
| Tested | A record shows it was tried and worked: a restore test, a breach drill, an access review. |
| Verified | A named, qualified reviewer accepted the evidence. |
Each control says which level it needs. A policy alone is enough for some controls; others, such as backups or breach response, need a record that the thing was tried and worked. Uploading a file is a declaration of what it shows. Only a named reviewer, during a verification, decides whether it is accepted.
The same control at three levels
| Area | Documented | Implemented | Tested |
|---|---|---|---|
| Breach response | A breach plan naming who informs the Board and the people affected | The contact list and template messages, stored where the on-call person can reach them | Notes of a rehearsal, with the time each step took and what was changed afterwards |
| Access control | An access policy for the customer database | An export of current users and their roles from the system itself | The record of last quarter’s access review, with the accounts removed |
| Vendors | A data-processing clause in your template contract | The signed terms with each vendor that handles personal data | The annual check of a vendor’s security answers, with follow-ups closed |
| Retention | A retention schedule | The setting or script that deletes records after the period | The log of the last deletion run, with counts |
| Consent | The wording of the consent request | A screenshot of the live form, unticked by default | A stored consent record for a sample person, including a withdrawal |
What a reviewer looks for
- It is yours. Your organisation’s name, your systems, your dates. A template downloaded from the internet is not evidence until it has been adopted and used.
- It is current. Dated within the review period, and still true today. A contract with a vendor you no longer use does not show anything.
- It matches the control. A privacy policy does not show that access is limited; an access export does.
- It is complete enough. One signed vendor contract out of six shows the process exists, not that it covers everyone. Say what the sample is.
- It says who. Who approved the policy, who ran the test, who reviewed the access.
What not to upload
Evidence should show that a control works without exposing the people it protects. Do not upload customer lists, patient records, KYC documents or full database exports. Redact names and numbers in screenshots and logs, and use a sample record with the identifying details removed. If you do upload personal data, your organisation is the Data Fiduciary for it and ReversePath only stores it for you.
Keeping it fresh
Give each item a review date. Policies are usually reviewed yearly; access reviews quarterly; vendor checks yearly; breach rehearsals yearly. Evidence past its review date stops counting until it is replaced, so the result never relies on something stale.
In the workspace, the Evidence Room holds each item against its control, checks files on upload, records who added what and when, and shows items coming up for review. Each industry guide lists the evidence typical for that sector.