Evidence in an IRAP assessment is not a single artefact. It is a triangulation of three different things, each answering a question the others cannot.
The first is design. A diagram, a written policy, a configuration baseline, a hardening standard — anything that describes how the system is supposed to behave. Design evidence is cheap to produce and easy to review, which is why most evidence packs lean on it heavily. It is also the form an assessor trusts least when it stands alone: a policy document is a statement of intent, not a statement of fact. An ISM control marked “implemented” with only a policy attached is a control that has been written about, not a control that has been verified.
The second is state. A configuration export from the actual environment. A screenshot of the console showing MFA enforcement on. The output of a query against the live IAM role set. State evidence answers the question the design cannot: at the moment of assessment, was the system actually configured the way the design said it should be. State is harder to fake, but it is a single point in time. A configuration captured the morning of the assessment may or may not survive contact with the following week.
The third is behaviour. Logs, alerts, attestations of operating practice, change-management records, ticket histories tied to the control. Behaviour evidence is the only form that speaks to the system over time — that the MFA policy actually fires, that the logging pipeline actually flowed, that the runbook actually got followed when the incident occurred. Behaviour evidence is the most expensive to produce and the slowest to assemble, which is why it is the most commonly missing.
An assessor working through an Annex A row reads all three together. Design without state is aspiration. State without design is unexplained. Behaviour without either is unanchored. Triangulating the three is how a “control implemented” judgement becomes defensible in a report that an authorising officer is expected to act on.
Building the pack from the start with all three in mind costs less than back-filling them under audit pressure in week three. It also produces a shorter Stage 2.
Takeaway. If your evidence pack only carries one of the three, the assessor’s report will carry the gap.
Published by TrustedZone news automation on 2026-05-19 AEST. Director rollback.