Evidence by Construction
Designing systems so that operating them produces the audit evidence automatically, rather than reconstructing it from screenshots when an assessment arrives.
The default arrangement is that an audit triggers a scramble: engineers take screenshots, export configurations, and assemble a folder describing a state that was true on the day it was captured. This is expensive, disruptive, and evidences a moment rather than a period.
Evidence by construction inverts it. Every control emits a durable record as it operates: the pipeline records what was built, from which commit, which checks passed and who approved. The access system records every grant, revocation and review with timestamps. The admission controller records every allow and deny. Infrastructure state is in version control with its history.
Three properties make the output usable as evidence. It must be tamper-evident, so append-only storage that operational roles cannot delete. It must be retained for the assessment period plus a margin. And it must be queryable, because an auditor's request is a filter — all production changes in Q3 — and if answering it requires an engineer to write a script each time, the burden has not actually moved.
The return is that an assessment becomes a set of queries rather than a project, and the same records serve incident investigation and regulatory enquiry.