Objectives are the unit of proof
A requirement like "enforce MFA" breaks down into objectives: is MFA implemented for this access class, for that one, for privileged accounts, and with which authenticator types? The assessor works down the objective list, so an evidence library indexed by objective answers questions as fast as they're asked. A library organized as "the MFA folder" answers nothing until someone spelunks it.
Three methods, three artifact types
| Method | What the assessor does | What your evidence must be |
|---|---|---|
| EXAMINE | Reviews documents, configurations, records | Exported policy sets, configuration screenshots with visible dates and tenant context, logs, registers |
| INTERVIEW | Questions the people who operate the control | Named control owners who can narrate the process without reading the SSP. When those people leave, this evidence goes with them |
| TEST | Exercises the mechanism to observe behavior | Enforcement you can reproduce on demand: the blocked login, the denied egress, the quarantined file |
Remapping Rev. 2 evidence
- Most artifacts carry over, but their index has to change. A Conditional Access export that evidenced a Rev. 2 objective usually evidences the corresponding Rev. 3 objective once you re-index it deliberately through the crosswalk. Renaming folders does not do that.
- Consolidated requirements concentrate evidence. Where Rev. 3 merged Rev. 2 requirements, the merged objective set still expects proof for each parent. Map many-to-one and keep every artifact.
- Objectives with ODPs need evidence that shows the value. If the parameter says weekly review, the evidence must show weekly reviews; a generic "reviews happen" artifact is no longer enough. Pair each of these artifacts with its register row.
- New-family objectives need new evidence. SCRM plans, acquisition security records, and most planning artifacts have no Rev. 2 ancestors. Budget time to collect them on top of the mapping work.
Refresh evidence on a schedule
Evidence goes stale. A rolling refresh calendar re-captures each objective's artifacts on a defined cadence as a byproduct of normal operations, which is easier to sustain than a collection sprint before every assessment. Our managed compliance service runs that calendar.
Evidence remapping is a fixed deliverable of the transition.
We re-index your Rev. 2 artifact library to 800-171A Rev. 3 objectives, identify the gaps, and set up the refresh calendar. Or email rj@indirectit.com directly.