Confidential — Evidence Bundle · Client CompanyEvidence Index · Generated 2026-08-25 · Sample
Evidence Index
Client Company — companion to the Evidence Bundle ZIP: one folder per control, every file hash-verified
Inside the bundle ZIP, each control with evidence has its own folder under Evidence/. In the ZIP's own index.html the folder names below are clickable links; this printable copy shows them as paths. Controls showing zero have no folder — that absence is itself information for a responder. SHA-256 hashes for every file are in manifest.csv.
| Control | Title | Files | Folder / contents |
|---|---|---|---|
| 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | 2 | Evidence/1.1/ — asset-inventory-export.txt, inventory-review-notes.txt |
| 4.6 | Securely Manage Enterprise Assets and Software | 0 | — |
| 6.3 | Require MFA for Externally-Exposed Applications | 1 | Evidence/6.3/ — conditional-access-policy.txt |
| 6.5 | Require MFA for Administrative Access | 1 | Evidence/6.5/ — admin-mfa-rollout-plan.txt check-in #2 |
| 8.9 | Centralize Audit Logs | 0 | — |
| 10.1 | Deploy and Maintain Anti-Malware Software | 3 | Evidence/10.1/ — edr-console-coverage.txt, edr-policy-export.txt, deployment-checklist.txt |
| 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | 2 | Evidence/11.4/ — backup-isolation-diagram.txt, notes.txt check-in #1 |
| 12.2 | Establish and Maintain a Secure Network Architecture | 0 | — |
| 14.1 | Establish and Maintain a Security Awareness Program | 2 | Evidence/14.1/ — training-completion-report.txt, phishing-sim-results.txt |
| 17.4 | Establish and Maintain an Incident Response Process | 0 | — |
Reading this during an incident
- Zero-count controls tell you what documentation does not exist — don't burn response time asking for a network diagram the index says was never filed.
- The check-in tag marks evidence added after the baseline; manifest.csv records which round contributed each file.
- Verify any file you rely on against its SHA-256 in manifest.csv before quoting it in a report.