---
name: evidence-collection
type: scheduled
owner: human
frequency: "monthly"
---

**Purpose:** Maintain audit-ready evidence packages with current screenshots, logs, and attestations.

**Procedure:**
- [ ] Capture current-state screenshots for visual controls
- [ ] Export access logs for the review period
- [ ] Collect signed attestations from control owners
- [ ] Update the evidence index with new artifacts
- [ ] Verify evidence chain is continuous (no gaps)

**Signals:**
- Monthly collection cadence
- Approaching audit dates
- After any remediation is completed
