Chapter 48 — Evidence dossier | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 48 — Evidence dossier

Lesson map

Lesson 48 published. Map, example, EX142.

flowchart TD
  N0["Learning outcomes"]
  N1["48.1 Purpose"]
  N2["48.2 Structure"]
  N3["48.3 Honest status"]
  N4["48.4 Auditability"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX142"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["48.1 Purpose"]
  N2["48.2 Structure"]
  N3["48.3 Honest status"]
  N4["48.4 Auditability"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX142"]

[Learning outcomes]
    |
    v
[48.1 Purpose]
    |
    v
[48.2 Structure]
    |
    v
[48.3 Honest status]
    |
    v
[48.4 Auditability]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX142]

Learning outcomes

You will (1) assemble verification and measurement evidence; (2) structure the dossier around requirements; (3) make it auditable.

48.1 Purpose

The evidence dossier gathers proof that the identity programme met its requirements. Its readers are Sana's examiners, the council's auditors and the identity team. It must let a reader check any claim without trusting Sana's word: each requirement links to tests, measurements and documents showing it was met, partly met or not met. A well-built dossier is also a lasting asset for the council, since future audits and changes can start from it rather than reconstructing evidence from scratch. It is kept under version control.

48.2 Structure

The dossier is organised by requirement group: authentication, authorisation, lifecycle, audit and operations. For each requirement it gives the statement, verification method, test results with configuration versions, measurement results with dates, and status. A summary table shows status across all sixty requirements. Separate sections hold the threat ranking, residual risk register, studio records, independent review and trial results. Consistent structure lets readers find evidence quickly and see gaps at a glance. Cross-references link related evidence across sections, and an index lists every evidence identifier.

48.3 Honest status

Of sixty requirements, fifty-three are met, five partly met and two not met. Partly met requirements include single sign-on coverage, which reaches 133 of 140 applications, and leaver removal for applications on interim scripted checks. Not met are a self-service group request feature, ranked could and deferred, and a reporting dashboard delayed by procurement. Sana records each with its reason and plan. Showing gaps plainly makes the dossier credible; a dossier claiming everything was met would invite suspicion. Status is reviewed by her supervisor.

48.4 Auditability

To make the dossier auditable, every evidence item has an identifier, date, source and storage location, and logs or screenshots are kept unaltered with checksums. Scripts used for measurements are included with their versions, and synthetic test data is stored alongside. An auditor can pick any requirement, follow its links and reach original evidence. Sana asks a council auditor to try this on three random requirements before submission; one broken link is found and fixed. Checksums are verified before submission.

Worked example

The dossier reports 53 met, 5 partly met and 2 not met of 60 requirements, with evidence items carrying identifiers, dates, sources and checksums; an auditor's trial finds one broken link, now fixed.

Synthetic case. Requirements, counts and evidence are synthetic.

Errors and limits

A dossier that claims every requirement was fully met invites suspicion rather than trust.

Exercises

EX142 — Requirement status. How many requirements are met, partly met and not met? Rubric: 3 = 53, 5, 2;; 2 = 53 met;; 1 = all;; 0 = none.
EX143 — SSO coverage final. What single sign-on coverage does the dossier report? Rubric: 3 = 133 of 140 applications;; 2 = 133;; 1 = 140;; 0 = none.
EX144 — Auditor trial. What did the auditor's trial find? Rubric: 3 = one broken link among three requirements;; 2 = one issue;; 1 = vague;; 0 = none.

Synthesis

A requirement-structured, honest and auditable dossier proves what was achieved and what remains.

Continue studying — chapter 48 of 50

← Chapter 47 (draft) · Course chapter index · Chapter 49 (draft) →