Evidence Register

policy · reviewed annually

The written rules for who gets accounts and how they are approved, how people, service accounts and devices are identified, and how each must authenticate. One document with sections serves AC.L1-b.1.i, IA.L1-b.1.v and IA.L1-b.1.vi.

Approved, dated document signed by the owner or manager; add sections rather than writing three policies.

• AC.L1-b.1.i [a, b, c] · Named in the assessment guide
• IA.L1-b.1.v [a, b, c] · Named in the assessment guide
• IA.L1-b.1.vi [a, b, c] · Named in the assessment guide

record · dated within 30 days

The antivirus console's device report: protection on, definition and engine versions, and last scan per device.

Export or screenshot the device list from the Microsoft Defender portal, Intune or your antivirus console, and match it to your device inventory.

• SI.L1-b.1.xiii [b] · Named in the assessment guide
• SI.L1-b.1.xiv [a] · Named in the assessment guide
• SI.L1-b.1.xv [b] · Named in the assessment guide

policy · reviewed annually

Where malware protection runs, how its updates are applied, and how often systems are scanned. One short section of your security policy serves SI.L1-b.1.xiii, xiv and xv.

A dated policy section naming the locations, the update rule and the scan frequency.

• SI.L1-b.1.xiii [a] · Named in the assessment guide
• SI.L1-b.1.xiv [a] · Named in the assessment guide
• SI.L1-b.1.xv [a] · Named in the assessment guide

record · reviewed on your schedule (quarterly is common)

Every account or process that signs in on its own (service accounts, scheduled tasks, connectors, scan-to-email devices), with owner, purpose, the system it reaches and how it authenticates.

A spreadsheet, or an export from your identity provider with owner and authentication-method columns added.

• AC.L1-b.1.i [b, e] · Example
• IA.L1-b.1.v [b] · Example
• IA.L1-b.1.vi [b] · Example

record · most recent two reviews

A dated record that the user, service account and device lists were checked against reality, with what was removed or fixed.

A dated note, ticket or signed checklist naming the reviewer.

• AC.L1-b.1.i [a, c] · Named in the assessment guide
• IA.L1-b.1.v [a, b, c] · Example

configuration export · current configuration

The antivirus policy settings: real-time and tamper protection, update source and frequency, scheduled scan type and time.

Export or screenshot the policy from Intune, Group Policy or the antivirus console.

• SI.L1-b.1.xiv [a] · Example
• SI.L1-b.1.xv [b] · Named in the assessment guide

record · dated within 90 days of the assessment

Every person with an account on systems that hold FCI, with role and the systems they may use.

Export the user list from your identity provider or directory and add role and approval columns.

• AC.L1-b.1.i [a, d] · Named in the assessment guide
• IA.L1-b.1.v [a] · Named in the assessment guide

record · dated within 90 days

Every device allowed to connect, with unique name or asset tag, serial number, owner and enrollment status.

Export from your device management console or RMM, or keep a spreadsheet; match it to the router's client list.

• AC.L1-b.1.i [c, f] · Example
• IA.L1-b.1.v [c] · Example

screenshot · current configuration

The setting that lets only enrolled or approved devices reach company apps (Conditional Access, context-aware access, or your equivalent).

Screenshot the rule with its conditions and the apps it covers.

• AC.L1-b.1.i [d, f] · Example
• AC.L1-b.1.iii [f] · Example

screenshot · current configuration

Your email service's malware, attachment and link-scanning settings.

Screenshot the anti-malware and attachment policies in your email admin console.

• SI.L1-b.1.xiii [b] · Example
• SI.L1-b.1.xv [c] · Example

configuration export · current configuration

The firewall's current rules, including any DMZ and segment rules.

Export the rule set from the firewall or its cloud console.

• SC.L1-b.1.x [e, f] · Named in the assessment guide
• SC.L1-b.1.xi [b] · Named in the assessment guide

diagram · updated when the network changes

Your internet connections, firewall, internal segments, public-facing components and cloud services, with the boundaries marked.

A simple drawing (Visio, draw.io or a photo of a whiteboard) with a date and owner.

• SC.L1-b.1.x [a, b] · Named in the assessment guide
• SC.L1-b.1.xi [b] · Named in the assessment guide

procedure · reviewed annually

How physical access is authorized and limited, how visitors are escorted and logged, and how keys, badges and codes are issued and revoked. One document serves PE.L1-b.1.viii and ix.

A dated procedure with a section for each.

• PE.L1-b.1.ix [a, b, c, d, e, f] · Named in the assessment guide
• PE.L1-b.1.viii [a, b, c, d] · Named in the assessment guide

configuration export · current configuration

The policy that blocks malicious and unapproved sites and services, at the firewall, a DNS filter or the endpoint.

Export or screenshot the filtering policy and its blocked categories.

• AC.L1-b.1.iii [e] · Example
• SC.L1-b.1.x [c, e, g] · Example

policy · reviewed annually

Signed policy with the approved-services list and personal-device rules.

• AC.L1-b.1.iii [c, d] · Named in the assessment guide

record · most recent review

Dated note comparing the list to actual key and badge holders.

• PE.L1-b.1.viii [a, b, c, d] · Named in the assessment guide

record · most recent three months

Weekly advisory review log (date, items reviewed, action) and monthly vulnerability scan or patch report.

• SI.L1-b.1.xii [b, d] · Named in the assessment guide

screenshot · current configuration

Screenshot of Intune or Group Policy update rings, Google endpoint update settings, or RMM patch policy.

• SI.L1-b.1.xii [b, f] · Example

log · retained for your defined period

Export from the access-control system, if you have one.

• PE.L1-b.1.ix [c] · Named in the assessment guide

configuration export · current configuration

Screenshots of the VPN settings, the Wi-Fi security mode for each SSID, and the firewall's administrative access settings (HTTPS/SSH only, internal interface only).

• SC.L1-b.1.x [g, h] · Example

log · dated within 90 days

Sample of the firewall's daily digest emails or a log export showing denied connections at the edge and between segments.

• SC.L1-b.1.x [c, d] · Named in the assessment guide

record · each pickup in the assessment period

Certificates from the shredding or e-waste vendor listing items or weight and date.

• MP.L1-b.1.vii [a] · Example

record · one for every device in the inventory

Checklist or ticket per device showing the default credential was changed, by whom and when.

• IA.L1-b.1.vi [a, c] · Named in the assessment guide

screenshot · current configuration

Screenshot of the Entra, Google or AD device list showing joined devices, and of the wireless controller showing WPA2/WPA3 security and a separate guest network.

• IA.L1-b.1.vi [c] · Example

record · within the last 12 months

Results of an nmap scan or a CISA Cyber Hygiene report of your public IP addresses, matched against the inventory.

• SC.L1-b.1.xi [a, b] · Example

screenshot · current configuration

SharePoint/OneDrive or Google Drive sharing settings showing restricted external sharing and allowed domains.

• AC.L1-b.1.iii [e, f] · Example

record · reviewed quarterly

Spreadsheet of each external service, data involved, owner, approval date.

• AC.L1-b.1.iii [a, b] · Example

diagram · current

Simple floor plan marking locked doors, the network closet and printer locations, with photos of the locks.

• PE.L1-b.1.viii [b, c, d] · Example

record · dated within 90 days

SharePoint site permissions page screenshots, Google Drive shared-drive member list, or an NTFS permissions report for the FCI share.

• AC.L1-b.1.ii [b] · Example

record · dated within 90 days

Export security group members from Entra ID (`Get-MgGroupMember`), Active Directory or Google Admin.

• AC.L1-b.1.ii [b] · Example

other · current

Hosting account page or contract showing the website runs at the provider, not on company equipment.

• SC.L1-b.1.xi [b] · Example

record · every departure in the assessment period

Offboarding checklist entries or access-system audit log showing returns, disablement, rekeying or code changes.

• PE.L1-b.1.ix [f] · Named in the assessment guide

configuration export · current configuration

Intune or Group Policy setting that removes standard users from local Administrators, or a screenshot of the local Administrators group on a sample workstation.

• AC.L1-b.1.ii [b] · Example

record · most recent two quarters

Dated note or ticket for each monthly log check and quarterly rule review, listing what was changed.

• SC.L1-b.1.x [c, d, e, f] · Example

procedure · reviewed annually

Short dated document referencing NIST SP 800-88 and listing methods per media type.

• MP.L1-b.1.vii [a, b] · Named in the assessment guide

record · dated within 90 days

Entra admin center > Authentication methods > User registration details export, or Google Admin 2-Step Verification enrollment report.

• IA.L1-b.1.vi [a] · Example

screenshot · dated within 90 days

Router, firewall or DHCP client list with each entry marked against the device inventory.

• IA.L1-b.1.v [c] · Example

policy · reviewed annually

One or two page dated policy stating identification frequency, reporting time and correction deadlines by severity.

• SI.L1-b.1.xii [a, c, e] · Named in the assessment guide

record · dated within 30 days

Report from Intune, RMM, Action1 or Windows Update showing devices and their patch status.

• SI.L1-b.1.xii [f] · Named in the assessment guide

screenshot · current

Photo showing the cross-cut shredder or locked console where FCI paper goes.

• MP.L1-b.1.vii [a] · Example

screenshot · current

Photo of the visitor badge style and the locked key storage.

• PE.L1-b.1.ix [b, e] · Example

record · reviewed at least annually and after departures

Spreadsheet or access-control system export of authorized people, areas and credentials.

• PE.L1-b.1.viii [a] · Named in the assessment guide

record · reviewed at least annually

Spreadsheet of keys, badges, fobs and codes with serials, holders and areas opened.

• PE.L1-b.1.ix [d, e] · Named in the assessment guide

policy · reviewed annually

Policy section naming roles or people allowed to publish and the review requirement.

• AC.L1-b.1.iv [a, b] · Named in the assessment guide

record · within the last year

Dated checklist of the annual website/social review, who did it, what was found.

• AC.L1-b.1.iv [d] · Named in the assessment guide

record · reviewed annually and on change

Short list of each internet-reachable service, its address, where it is hosted, its owner and why it is public.

• SC.L1-b.1.xi [a] · Example

screenshot · current configuration

CMS roles page showing Author vs Editor/Publisher, or the approval checklist with recent completed entries.

• AC.L1-b.1.iv [c] · Example

record · within the assessment period

Tickets or emails showing report and fix dates for significant flaws, plus documented exceptions with compensating measures.

• SI.L1-b.1.xii [d, f] · Named in the assessment guide

record · reviewed semi-annually

Spreadsheet listing roles against systems and functions, approved by the owner.

• AC.L1-b.1.ii [a] · Example

log · most recent twelve months

Spreadsheet or ticket history with date, item, serial, method and who performed it.

• MP.L1-b.1.vii [a, b] · Named in the assessment guide

procedure · reviewed annually

One-page procedure with contacts and cache-purge steps.

• AC.L1-b.1.iv [e] · Named in the assessment guide

log · retained for your defined period (for example one year)

Sign-in book or visitor-management export showing visitor, host or escort, and times.

• PE.L1-b.1.ix [a, b, c] · Named in the assessment guide