NIST CSF Example Evidence

The table below lists commonly evidenced control areas for the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the artifacts that typically satisfy them; attach these to your controls as evidence.

Control Area	Example Evidence
Change review process	Branch protection settings and merge request rules showing code changes are peer reviewed and approved by someone other than the author before reaching production
Restricted production deployment	Documentation of who is authorized to deploy production changes, including administrators, CI/CD pipeline triggers, and repository owners
Separate environments	Screenshots showing distinct development, testing, staging, and production environments on separate URLs or infrastructure
External communication channels	Customer-facing support channels such as a support portal, help desk page, or in-product communication features
Internal communication channels	Internal messaging channels dedicated to reporting security events, or a whistleblower channel
Periodic access reviews	Records showing user lists and permissions were reviewed, reviewer approval, and follow-through on any changes identified
Baseline configuration and hardening standards	Documented baseline configuration standards or hardening checklists (for example, Center for Internet Security (CIS) Benchmarks) with proof of implementation and periodic updates
Organizational chart	Current organizational chart from an HR system or people directory showing personnel and reporting lines
Periodic risk assessment	Risk assessment documentation listing identified risks, associated threats and vulnerabilities, and likelihood and impact ratings
Risk treatment plan	Risk register or treatment plan showing the selected treatment option for each risk and planned remediation actions
Penetration testing	External penetration test report with scope and results, evidence of management review, and tracking of resulting findings
Asset inventory	Centralized asset register with owner, description, location, and classification for each asset
Network diagram	Current network diagram with approval records or review sign-off from within the past year
Continuity and recovery testing	Documentation of a recent continuity or disaster recovery exercise: the plan, participants, activities performed, results, and lessons learned
Security event tracking	An incident record showing priority, categorization, escalation, status tracking, and containment and remediation steps
Incident response team	Incident response plan, team charter, or responsibility matrix defining roles for incident handling and coordination
Incident lessons learned	Post-incident review showing root cause analysis, containment, eradication, and recovery actions with timelines and findings
Performance evaluations	A completed performance review from the past year showing evaluation against goals and reviewer sign-off
Defined roles and responsibilities	Roles and responsibilities sections of governance, security, privacy, and compliance policies, or a responsible, accountable, consulted, and informed (RACI) matrix
Candidate screening	Hiring records such as applicant tracking entries, interview schedules, resume reviews, reference checks, or technical assessments
Job descriptions	Documented job descriptions with role title, core responsibilities, reporting structure, and required qualifications
Vendor register and agreements	An up-to-date third-party register with vendor names, contacts, services, and risk ratings, plus executed agreements
Vendor compliance monitoring	Vendor assurance reports reviewed annually, such as System and Organization Controls 2 (SOC 2) Type II reports, International Organization for Standardization (ISO) 27001 certificates, or Payment Card Industry Data Security Standard (PCI DSS) attestations
Privileged access restrictions	Privileged user listings for cloud infrastructure, code repositories, the identity provider, and password vaults, with assigned roles
Session termination	Screenshots showing users are logged out after a defined period of inactivity and when the browser or application session closes
Customer commitments	Customer contracts, order forms, service descriptions, or trust center content communicating your service commitments
Multi-factor authentication	Screenshots of multi-factor authentication (MFA) enforcement settings or user-level MFA status for systems not covered by automated monitoring
Password policy and configuration	A documented password policy covering minimum length and complexity, plus screenshots confirming systems enforce it
Access provisioning	An access request record showing the systems requested, access level, business justification, approver, and approval date, plus completed provisioning
Access deprovisioning	Offboarding checklist, ticket, or account-disabled logs showing access revoked promptly after termination
Emergency change management	An emergency change ticket with the reason for the change, implementation details, date, and post-implementation review
Data backups	Backup system screenshots showing schedules, successful job history, and retention settings for production data
Centralized logging	Log sources feeding a central platform, sample alert rules and resulting notifications, and restricted access to the system
Network security controls	Firewall rules, security groups, or network access control lists (ACLs) showing traffic limited to what business needs justify
System monitoring	Availability or health monitoring dashboards, alert rules, sample alerts, and event triage documentation
Web application firewall	Screenshots showing a web application firewall (WAF) enabled for public-facing applications, the domains protected, active rule sets, and alert logs
Intrusion detection and prevention	Evidence that an intrusion detection and prevention system (IDS/IPS) or equivalent is enabled, the threat types monitored, and alerting configuration
Encrypted remote production access	Screenshots demonstrating production is reachable only through VPN, SSH, a bastion host, or another encrypted path
Capacity monitoring	Dashboards showing CPU, memory, storage, or network utilization with configured thresholds or alerts
Autoscaling	Autoscaling group settings, scaling policies, threshold triggers, capacity limits, and recent scaling activity
Backup storage	Evidence of backup encryption, replication to a different region, or air-gapped or logically separated backup storage
Backup monitoring	Backup alert configuration plus a ticket or incident record showing a failed backup was investigated and resolved
Backup restore testing	Documentation of a completed restore showing the steps taken, results, completion date, and data validation
Test data	Screenshots showing mock or synthetic data in non-production environments, or documented anonymization and masking procedures
Personnel confidentiality agreements	A signed non-disclosure agreement (NDA), proprietary information agreement, or employment or contractor agreement executed before the start date
Paper media disposal	Observation that hard-copy materials are disposed of by cross-cut shredding, incineration, or pulping
Secure physical storage	Photos or screenshots of locked cabinets, file rooms, storage closets, or secure cages with restricted access
Hardware media disposal	Certificate of destruction, media sanitization record, or device disposal log showing secure wiping before reuse or disposal
Information disposal procedures	Documented disposal or media sanitization procedures and retention standards defining approved disposal methods
Security terms in third-party agreements	Master service agreements, data processing agreements, business associate agreements, or security addenda containing security obligations
Breach and incident notification	A documented notification procedure, decision tree, and templates for communicating incidents to stakeholders
Privacy point of contact	A privacy email address, web form, or portal through which privacy requests and incident reports are received
Leadership oversight	Agenda and minutes from the most recent board or senior leadership meeting covering compliance, risk, and security
Removable media encryption	Endpoint management or device encryption settings enforcing encryption of removable media
Data loss prevention	Data loss prevention (DLP) rules configured in email, endpoint, cloud storage, or collaboration systems to block leakage and generate alerts
Incident response testing	Records of a tabletop exercise, walkthrough, or simulation: scenario, participants, activities, results, and lessons learned
Change testing	Change records with test or acceptance criteria and results from CI/CD or QA test runs
Cybersecurity insurance	Certificate of insurance or declarations page showing the insurer, coverage types and amounts, and effective and expiration dates
Continuous control monitoring	Compliance automation tooling showing your control inventory, test results, and remediation workflows
Legal and regulatory requirements	A legal, regulatory, and contractual obligations register with assigned owners and review tracking
Independent assessments	An internal audit plan showing scope, timing, and assessor, plus the completed report, findings, and corrective actions
Business continuity plan	A documented plan defining continuity strategies, recovery approaches, roles, activation criteria, and communication procedures
Business impact analysis	A business impact analysis (BIA) identifying critical processes and assets, criticality ratings, recovery order, minimum service levels, and recovery assumptions
Vendor management policy	Policy defining third-party onboarding, due diligence, risk classification, contract and security review, and ongoing monitoring
Employment terms	Executed employment agreements, offer letters, or contractor agreements acknowledging information security responsibilities
Communications plan	A documented communication plan or matrix defining what is communicated, to whom, when, and how
Secure information transfer	Data protection, secure transfer, or encryption standards defining approved transfer methods and encryption requirements
Asset management policy	Policy covering identification, tracking, ownership, classification, maintenance, transfer, return, and disposal of assets
Vulnerability management	Policy defining how vulnerabilities are identified, cataloged, risk-rated, prioritized, and tracked, with roles and timelines
Threat intelligence	A documented threat intelligence procedure, subscribed commercial or open-source threat feeds, and internal assessments
Advisory and interest group participation	Subscriptions to advisories or bulletins (for example, Cybersecurity and Infrastructure Security Agency (CISA) or CERT alerts) and participation in professional groups
Designated security officials	Organizational documentation formally assigning information security responsibility to a named leader
Network configuration standards	Firewall, router, ACL, or cloud network configuration standards showing approved rule requirements and business justifications
Dataflow diagram	Current dataflow diagram with approval records or review sign-off from within the past year
Minimal system functionality	Screenshots showing enabled services, disabled unnecessary functionality, and alignment to the approved baseline configuration
Secure data disposal	Deletion tickets, retention schedule execution records, or fulfilled customer deletion requests with verification of deletion
Anti-malware configuration	Screenshots of scheduled scan settings, real-time protection, and behavioral analysis settings
Production change control	Change records showing the description, business justification, evaluation of security impact, and approval by authorized parties
Secure development training	Training materials covering secure design, secure coding, and vulnerability detection tools, plus completion records
Need-to-know access	A role-based access matrix, documented role definitions, and permission assignments aligned to job responsibilities
Access control model	A documented access control standard defining the model in use (role-based access control (RBAC), attribute-based access control (ABAC), or similar) with matching system configuration
Facility entry controls	Photos of badge readers, biometric readers, or a monitored reception desk, with door access system settings and access logs
Tamper-resistant physical controls	Photos of video monitoring, sensors, or detectors showing secured mounting, locked enclosures, and restricted administrative access
Physical access data review	A documented review procedure and completed review records correlating camera footage with badge or visitor log data
Visitor authorization and escort	Observation, on-site or virtual, that visitors are authorized before entry and escorted at all times
Personnel and visitor badges	Observation that onsite personnel wear identification and visitors are issued visitor badges
Visitor log	A maintained visitor log providing an audit trail, such as a scan or photograph of the log for a sample day
Audit logging	Screenshots showing audit logging enabled, the systems and data covered, and the settings in effect
Audit log contents	A sample log showing user identity, event type, date and time, success or failure indication, and affected data
Failed access logging	Sample log exports capturing failed login attempts and access denials
Authentication change logging	Sample logs showing account creation, privilege elevation, and changes to accounts with administrative access
Restricted audit trail access	Screenshots showing which users hold administrative or privileged access to log systems, restricted appropriately
Audit trail protection	Access control settings for log repositories and immutable or write-restricted storage settings
Logging policy	A policy, standard, or procedure defining logging requirements, monitoring activities, roles, and alert review expectations
Wireless access point detection	Wireless scan results or rogue access point reports distinguishing authorized from unauthorized devices
Vulnerability remediation	A vulnerability report listing critical, high, and other applicable findings with rescan results confirming remediation
Change detection	File integrity monitoring or equivalent configuration showing monitored file paths or objects and monitoring rules
Multiple awareness methods	A security awareness schedule or curriculum, training records, newsletters, and phishing simulation records showing multiple channels
Vendor due diligence	Completed security questionnaires, reviewed compliance reports or certifications, and documented analysis of vendor risk
Incident response training	Incident identification and reporting training for all personnel, role-specific handler training, and completion records
Software installation restrictions	An approved software inventory or allowlist plus mobile device management (MDM), endpoint management, or application control settings restricting installation
Nonconformity management	Records showing root cause analysis, corrective actions, and verification that those actions worked
Change management policy	Policy defining how changes are requested, reviewed, approved, tested, implemented, documented, and tracked
Information labeling	A data classification policy and labeling standard, with screenshots showing labels applied
Disciplinary process	Employee handbook, code of conduct, or HR policy describing the process, plus a redacted example of disciplinary documentation
Fire detection and suppression	Observation of smoke detectors, alarms, sprinklers, or clean agent suppression in critical locations, with maintenance logs
Temperature monitoring	Observation or screenshots of HVAC, environmental sensors, or building monitoring, with maintenance and calibration records
Uninterruptible power supply	Observation of uninterruptible power supply (UPS) units in critical locations, monitoring console screenshots, and maintenance records
Device identification and authentication	A device registry plus network access control (NAC), MDM, or identity and access management (IAM) configuration showing device authentication and compliance checks
System identifier management	Documented procedures for assigning unique identifiers and evidence that terminated or retired identifiers are disabled
Remote maintenance	A maintenance ticket with session logs showing connection start and end times, plus monitoring or supervision records
Maintenance personnel authorization	A maintenance authorization procedure and a current list of authorized maintenance personnel or service providers
Secure development process	A software development lifecycle (SDLC) procedure or engineering standard integrating security across requirements, design, development, testing, release, and maintenance
Patch management	Patch management or endpoint management tool screenshots with patch status or compliance reports
Network security policy	Policy defining how network security controls such as firewalls, security groups, routers, and ACLs are deployed and operated
Phishing simulations	Campaign configurations, example simulated phishing emails, campaign schedules, and participation records
Processing redundancy	Architecture diagrams showing redundant network paths, load balancers, and clustered or replicated resources, with testing records
Email protection	Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) configuration, secure email gateway settings, anti-phishing and anti-spam rules, and sample alerts
Return of assets	Offboarding checklists, tickets, or asset return logs showing assets returned and access mechanisms disabled
On-call coverage	On-call rotation schedules, alerting platform screenshots, and escalation policies showing incident response coverage
Automated log review	Security information and event management (SIEM) or log management platform screenshots showing correlation rules, log aggregation, and alerting logic
No hard-coded credentials	Secret scanning, static application security testing (SAST) rules, or CI/CD pipeline checks showing hard-coded credentials are detected and removed before release
Software component inventory	A software bill of materials, software composition analysis (SCA) output, or application inventory showing components and versions
Static application security testing	SAST tooling in CI/CD or repository protections, with sample scan results and remediation tickets from before release
Logging and monitoring policy	Policy defining audit logging requirements, system activity monitoring, roles, and alert review expectations
Contact with authorities	Incident response procedures, playbooks, or communication plans identifying relevant authorities and how to reach them
Segregation of duties	A segregation of duties matrix, RACI, or role definitions showing incompatible duties separated, with compensating controls documented
Network segmentation	Zone diagrams, firewall rules, and VLAN or subnet configuration showing separate zones with approved traffic controls between them
Leak detection	Observation or photos of leak detection sensors, alarms, or building monitoring in critical locations
Forensic evidence handling	An incident response or evidence handling procedure covering preservation, plus training records for relevant personnel
Supplier service changes	Updated vendor risk reviews, change requests, security review records, or revised contracts showing approval of supplier changes
Least privilege	A role-based access matrix, IAM group or role definitions, and permission sets showing access limited and broad permissions restricted
Web filtering	Secure web gateway, DNS filter, proxy, or browser security settings showing blocked categories and access restrictions
Software composition analysis	SCA tool, pipeline check, or dependency management output identifying third-party components and license or policy compliance
Supported components	Supported software and hardware standards, approved version inventories, and replacement plans for unsupported components
Company objectives	Mission and vision statements, strategic plans, annual operating plans, or OKRs communicated to personnel
Interested party expectations	A stakeholder register, stakeholder analysis, or scope documentation identifying stakeholders, their expectations, and related controls
Transfer access validation	Role change tickets, HR transfer records, or access review records showing access updated to match new job responsibilities
Security impact assessment for changes	Change records identifying security implications and required controls, plus post-implementation validation
Cloud configuration monitoring	Cloud security posture management output showing enabled policies, recent scan reports, and remediation tracking
Physical access device control	A physical access procedure plus an inventory of keys, badges, and fobs with issuance, return, and deactivation records
Removable media control	A removable media or acceptable use policy with documented exceptions and evidence of technical enforcement
Role-based security training	Role descriptions identifying security duties, a role-based training curriculum, and completion records
Training program updates	A procedure requiring scheduled training program reviews, completed review records, and updated materials
Incident handling capability	A formally approved incident response plan, recent incident records showing analysis through recovery, and training records
Network traffic monitoring	Network monitoring or detection and response configuration, with alert records or investigation tickets
Supply chain risk management program	A program plan or strategy defining objectives, scope, roles and responsibilities, implementation milestones, and governance
Integrated supply chain risk management	Evidence that supply chain risk assessments feed enterprise risk treatment plans and are managed alongside other enterprise risks