Evidence Gap on a Control
A control has no current evidence within its required cadence, so it is reported as EVIDENCE GAP rather than PASS, PARTIAL or FAIL.
Updated Aug 16, 2026evidencecompliance
- Trigger
- A control's most recent evidence is missing or older than its defined cadence.
- Risk
- An evidence gap is not a failure, but it does lower assurance confidence for the control and any framework requirement it supports. Left unresolved, it prevents demonstrating compliance even where the underlying control may in fact be sound.
Prerequisites
- Identify the evidence source (collector, connector or manual process) that normally supplies this control
- Confirm whether the source is disconnected, offline or simply not yet run
- Confirm who is authorized to supply manual evidence if the automated source cannot be restored quickly
Recommended fix
- Open the control and identify which evidence source last supplied data for it.
- Check whether the source integration or collector is connected and healthy.
- If disconnected, reconnect or repair the source, then re-run evidence collection.
- If the automated source cannot be restored in time, upload manual evidence such as a policy document, screenshot or signed attestation.
- Confirm the control moves to a definitive state (PASS, PARTIAL or FAIL) once new evidence lands.
Validation
- Control shows fresh evidence within its cadence window
- Control state moves from EVIDENCE GAP to a definitive state
- Assurance confidence for the affected framework improves accordingly
Rollback and recovery
- No rollback applies; if manual evidence was uploaded incorrectly, replace it with a corrected version, preserving the prior version in the append-only history.
Evidence generated
- Restored automatic evidence record, or a new manual evidence upload with reviewer attestation
- Updated control state observation