# Evidence worksheet

Cyber Career Playbook | Edition 01 | Free educational resource

All organizations, records and cases below are fictional. This is a reasoning exercise, not a prescribed audit procedure, assurance opinion or certification assessment. There is no upload or scoring service attached to this file.

## Start here

Open evidence-register.csv in spreadsheet software or use the blank record below in any text editor. Save your own copy. Read the completed NS-01 row, then spend ten minutes on each unfinished row. Write observations before recommendations. Use only fictional or safely synthetic material in portfolio work; never include employer or customer records without appropriate permission.

The register separates what someone claims from what the supplied record supports. Its columns are prompts, not a complete assessment methodology. You may need different fields for a real engagement.

## Blank record

- Record ID:
- Fictional scenario or authorized scope:
- Claim being examined:
- Population covered by the claim:
- Period covered by the claim:
- Evidence received:
- Evidence source:
- Evidence date:
- Observation directly supported by that evidence:
- Limitation or unanswered question:
- Specific next evidence request:
- Responsible owner:
- Agreed requested date:
- Status and reason:

Keep evidence date, activity date and review period distinct. “Received today” does not establish when an activity happened. Do not fill missing dates with assumptions.

## Worked row NS-01: the later snapshot

Northline's practice policy requires monthly billing-access reviews. An export dated May 3 and a general approval message do not establish the population examined during April, the review date, reviewer authority or exception resolution. The supplied export supports a description of the listed accounts at its export time. It cannot establish that deleted April accounts were reviewed.

Ask for the April review record and its supporting population. Reconcile that scope to the later export, asking about additions and removals if relevant. Record the review as unverified from the supplied evidence. Do not write “the owner never reviewed access”: absence of a supplied record alone does not support that statement.

## Practice NS-02: the later approval

First write your own observation. The deployment log shows 14:10 and the approval entry shows 16:45 on the same day. Before concluding that approval occurred late, check whether the timestamps use the same time zone, what event each timestamp represents and whether another authorization record exists.

A defensible initial note: “The supplied records show an approval entry later than the deployment entry. They do not yet establish pre-implementation approval.” Request the authorization history and explanation of the two timestamps. If an emergency process is claimed, request its applicable requirements and supporting record. Do not invent an emergency exception or assume one excuses the sequence.

## Practice NS-03: the excluded service

The supplied report does not cover the planned managed file-transfer service. That scope mismatch limits its usefulness for this onboarding decision; it does not establish that the supplier is unsafe or that the excluded service has no controls.

Request evidence relevant to the actual service and intended data use, including the applicable scope and period. Clarify the proposed service and data flow with the relationship owner. Keep acceptance or rejection with the authorized decision-maker. Your output is a clear evidence gap and follow-up, not an unsupported risk rating.

## Read your work aloud

Can a reader locate the exact record behind each observation? Have you separated fact, inference and unanswered question? Does your request address the specific gap? Have you named the decision you are not authorized to make? If the evidence changes, is it clear which conclusion you would revisit?

## Describe the exercise honestly

Example portfolio caption: “Independent fictional evidence-review exercise. Created a three-record register separating observations from evidence gaps and drafted targeted follow-up requests. No real systems or customer records were assessed.”

Do not describe this exercise as an employer engagement, completed audit or professional certification. Keep it in a projects or learning section when using it in an application.

## Continue

Career paths: https://cybercareerplaybook.com/careers
Portfolio labeling: https://cybercareerplaybook.com/guides/grc-portfolio-project-labeling
Larger original portfolio case and book preview: https://cybercareerplaybook.com/playbooks/portfolio-kit

The planned canonical domain may not be connected during the development edition. Use the equivalent paths on the preview site when necessary.