Skip to content

Evidence Capture Manifest

Purpose. A short chain-of-custody record for a piece (or batch) of evidence: what it is, which control it proves, who captured it, when, how, and its SHA-256 integrity hash. The manifest lives in this repo (it holds no secrets or personal data); the artefact itself lives in the S3 evidence store. Part of the Evidence Collection and Management Procedure (ISMS-DOC-07-7); supports 7.5 / A.5.33.

How to use. Copy the blank template below into a new record (or keep a per-quarter batch file), fill it in when you capture evidence, then update the matching row in the Evidence Register. Never paste secrets, tokens or customer personal data into the manifest — describe, don't reproduce.

Fields

Field Meaning
Ref The clause / Annex A control this proves (e.g. A.8.13, 9.2)
Description What the artefact shows, in one line an auditor can understand
Artefact / S3 key The object in the store, named per ISMS-DOC-07-7 §4.5
Captured by Person who captured it
Capture date YYYY-MM-DD (visible date in the artefact is stronger)
Method Screenshot · config/CLI export · log extract · report · signed record
Command / source Exact read-only command or UI path used (if any)
SHA-256 shasum -a 256 <file> — integrity hash
Personal data? None / redacted / present-and-minimised (+ why needed)
Retention Object Lock retention applied (mode + until-date), per §4.4
Notes Anything an auditor should know (scope, caveats)

Blank template (copy me)

Ref:              <clause / control, e.g. A.8.13>
Description:      <one line: what this shows>
Artefact/S3 key:  <year>/<ref>/<YYYY-MM-DD>__<ref>__<desc>__<capturer>.<ext>
Captured by:      <name>
Capture date:     <YYYY-MM-DD>
Method:           <screenshot | config export | log extract | report | signed record>
Command/source:   <exact command or UI path, or n/a>
SHA-256:          <hash>
Personal data?:   <none | redacted | present-and-minimised — reason>
Retention:        <Governance/Compliance, until YYYY-MM-DD>
Notes:            <optional>

Worked example (illustrative — not real evidence)

Ref:              A.8.13
Description:      AWS RDS automated backups enabled + 7-day retention on prod DB
Artefact/S3 key:  2026/A.8.13/2026-07-10__A.8.13__rds-automated-backups-enabled__melvin.png
Captured by:      Melvin Jacobson
Capture date:     2026-07-10
Method:           screenshot (AWS console, account + region visible)
Command/source:   RDS console ▶ databases ▶ rds-soon-soon-prd ▶ Maintenance & backups
SHA-256:          3f5b9c1e7a2d84f06b1c9e5a7d3f8b204c6e1a9d0f7b3c5e8a2d4f6b1c0e9a7d  (illustrative — compute the real one: shasum -a 256 <file>)
Personal data?:   none
Retention:        Governance, until 2029-07-10
Notes:            Pair with the restore-test record (separate manifest) for full A.8.13 proof.

Change log

Version Date Author Comments
0.1 2026-07-12 ISMS First draft — chain-of-custody manifest template with fields, blank template and a worked example.