Appearance
Evidence Fabric
Where to find it: Controls & Assurance, then Evidence Fabric (/evidence/fabric).
The Evidence Fabric is the connective tissue between "something happened in a system somewhere" and "we can state a compliance position and defend it".
The distinct pieces
These terms are used precisely in OrviQ and are worth learning, because collapsing them is where evidence models go wrong.
| Concept | Reference | What it is |
|---|---|---|
| Evidence Register | — | Manually held artefacts: documents, reports, screenshots, attestations |
| Evidence Connection | CON-YYYY-NNNN | A configured link to an external evidence source |
| Collector | COL-YYYY-NNNN | A definition of what to collect, from where, how often |
| Collector Run | CRN-YYYY-NNNN | One execution of a collector |
| Evidence Assertion | ASN-YYYY-NNNN | One observation about one subject at one time |
| Indicator Definition | IND-YYYY-NNNN | A deterministic rule evaluating assertions against a control and scope |
| Indicator Result | INR-YYYY-NNNN | One immutable evaluation outcome |
| Evidence Coverage | — | The proportion of the in-scope population covered |
| Control Effectiveness | — | The derived operational posture of a control |
The relationship graph
Everything converges on the assertion. Whether an observation arrives from a nightly collector, a webhook, an uploaded report or a signed attestation, it becomes the same kind of record — which is why manual and automated evidence can be evaluated by the same rules.
The assertion: the atomic unit
An evidence assertion answers four questions about one thing at one moment:
| Question | Field |
|---|---|
| About what? | The subject — an asset, an account, a service, or the organisation |
| Observing what? | The observed state |
| When? | The observation timestamp |
| From where? | The source origin |
Observed states
| State | Meaning |
|---|---|
pass | The observation met the expected condition |
fail | It did not |
partial | Partially met |
info | Informational; carries no pass or fail judgement |
inconclusive | The observation could not determine the answer |
Assertion statuses
| Status | Meaning |
|---|---|
active | Current and counted |
superseded | Replaced by a newer observation of the same subject |
disputed | Flagged as contested |
invalidated | Determined to be unreliable |
archived | Retained but out of scope for evaluation |
Source origins
| Origin | Meaning |
|---|---|
collector_run | Produced by an automated collector |
manual_evidence | Derived from an artefact in the Evidence Register |
attestation | A person attesting to a fact |
governed_test | The result of a governed control test |
push_api | Submitted through the authenticated push API |
webhook_push | Received via a webhook gateway |
trusted_integration | From a trusted integration |
Attestations are first-class
Some obligations genuinely can only be evidenced by a person stating something is true — a board approval, a policy acknowledgement, a physical inspection. OrviQ treats an attestation as a proper assertion with a subject, a state, a timestamp and an attester, rather than as a second-class note attached to a file.
Manual and automated paths
Both are fully supported, and neither is a degraded version of the other.
Manual path
- An artefact is uploaded into the Evidence Register.
- It is linked to controls and requirements.
- An assertion is recorded from it, stating what it demonstrates about which subject.
- Indicators evaluate the assertion.
Requires evidence.upload and assertion.create. Manual evidence and assertions are part of core compliance and do not require the Continuous Assurance entitlement.
Automated path
- A Connection is configured to an external source.
- A Collector defines what to collect and how often.
- Runs execute and produce assertions.
- Indicators evaluate them.
Requires the Continuous Assurance entitlement.
Push path
External systems can submit assertions directly through an authenticated push API or webhook gateway. Requires evidence_push.submit and the Continuous Assurance entitlement.
Integration & telemetry path
Telemetry ingested via Security Tool Integrations (e.g. Tenable, Nessus, Nipper, Qualys) and Cloud & Identity Discovery (e.g. Entra ID, Azure, AWS, Prowler) automatically feeds the Evidence Fabric:
- Host vulnerability scans produce per-asset assertions with finding counts and severity distributions.
- Configuration and benchmark checks (e.g. CIS benchmarks via Prowler or AWS Config) produce structured check assertions (
pass,fail,info). - Identity directory syncs produce directory account population observations (e.g. MFA registration and privileged role counts).
These assertions carry origin trusted_integration or collector_run and participate in indicator evaluations alongside manual and collector-driven assertions.
Evidence != effectiveness
Semantic Doctrine: Evidence != effectiveness
A core doctrine of OrviQ is that evidence collection does not equal control operating effectiveness:
- Assertions are atomic observations: An assertion records an observed technical state about a subject at an instant in time (e.g. "Host A has no critical vulnerabilities", "User B has MFA registered").
- Coverage is not effectiveness: Having 100% evidence coverage across a population simply means every subject was observed. If 5% of those subjects failed the check, the control is ineffective despite complete coverage.
- Thresholds and determinations matter: Operating effectiveness requires evaluating assertions against deterministic indicator definitions (
IND-YYYY-NNNN) with explicit thresholds (all_pass,threshold_pct) across declared scopes (SCP-YYYY-NNNN). - Human accountability: Telemetry provides factual observations; formal determination of control effectiveness requires independent review and sign-off by control owners and assurance teams.
From assertions to coverage
Coverage is the question "how much of the population did we actually observe?"
For a population scope, the denominator is the count of effective-dated scope members at the evaluation instant. Each distinct member needs an active, fresh assertion to be counted as covered.
For a qualitative scope, the denominator is 1 — a single governance fact either has a valid observation or does not.
Coverage is never derived from how many files exist
Uploading forty documents does not produce 40% coverage of a hundred-subject population, or any coverage at all. Coverage counts distinct in-scope subjects with fresh assertions. An artefact covering one subject covers one subject.
Freshness
An assertion carries a freshness window. Beyond it, the assertion is stale — present, but no longer speaking to the current state.
Staleness is the difference between "we have evidence" and "we have current evidence", and it is the failure mode that quietly degrades most evidence libraries. See Expected Evidence & Freshness.
Worked examples
MFA configuration evidence
| Element | Value |
|---|---|
| Connection | Identity platform |
| Collector | Daily read of MFA enforcement state per privileged account |
| Assertions | One per account: subject the account, state pass or fail, freshness window 24 hours |
| Scope | SCP-2026-0012 — Privileged Accounts, population, 214 members |
| Indicator | all_pass, mandatory, daily |
| Result | 214 expected, 214 observed, 214 fresh, 211 pass, 3 fail, coverage 100%, result fail |
Coverage is complete and the control is ineffective. Both facts are true and both are visible.
Access review evidence
| Element | Value |
|---|---|
| Source | Quarterly access recertification exported from the IAM platform |
| Path | Manual upload, then assertions recorded per system reviewed |
| Assertions | One per system: state pass where the review completed, freshness window 100 days |
| Scope | SCP-2026-0007 — Payments Platform Production, 63 members |
| Indicator | threshold_pct, threshold 100%, quarterly |
| Result | 63 expected, 58 observed, 58 fresh, 58 pass, coverage 92.1%, result fail against the threshold |
Nothing failed the review. Five systems were not reviewed, which is a different and equally important problem — and the coverage figure says which.
Backup restore test evidence
| Element | Value |
|---|---|
| Source | Quarterly restore test, recorded as a governed test result |
| Assertions | One per database tested: state pass with the achieved restore time |
| Scope | Qualitative — the quarterly test itself |
| Indicator | qualitative_exists, quarterly |
| Result | Expected 1, observed 1, fresh, pass |
The scope is qualitative because the obligation is about performing the test, not about testing every database.
Policy approval evidence
| Element | Value |
|---|---|
| Source | Attestation by the Company Secretary that the board approved the policy |
| Assertions | One: subject the organisation, state pass, freshness window 12 months |
| Scope | Qualitative |
| Indicator | qualitative_exists, annual |
| Result | pass while fresh; stale after 12 months |
At month 13 this becomes stale automatically, which is precisely the reminder an annual governance obligation needs.
Permissions
| Action | Permission | Entitlement |
|---|---|---|
| View evidence | evidence.read | control_assurance |
| Upload evidence | evidence.upload | control_assurance |
| Review evidence | evidence.review | control_assurance |
| View assertions | assertion.read | compliance_core |
| Record assertions | assertion.create | compliance_core |
| View or manage connections | connection.read / connection.manage | continuous_assurance |
| View or manage collectors | collector.read / collector.manage | continuous_assurance |
| Execute collector runs | collector.run | continuous_assurance |
| Push assertions via API | evidence_push.submit | continuous_assurance |
Troubleshooting
"Evidence exists but coverage is 0%." Assertions were not recorded from it, or their subjects do not match scope members. An artefact in the register is not an assertion.
"Coverage dropped without anything failing." Assertions went stale, or scope members were added. Both reduce coverage without any observation changing.
"An indicator reports more subjects than my scope has." Scope membership is effective-dated. Check membership as of the evaluation timestamp rather than today.
"Evidence Fabric is not in the menu." Requires the continuous_assurance entitlement and connection.read. Manual evidence and assertions remain available without it.