Evidence register worksheet

The evidence register supports assessment of whether selected ORF requirements are implemented and continue to operate. Keep sensitive evidence in its approved system and link to a stable case, query, test, or artefact reference.

Outcome: an approver can determine requirement status without opening a nine-column spreadsheet or copying protected evidence into this page.

1. Status definitions

Status	Use when
Not assessed	Applicability and matrix obligation have not been reviewed
Planned	Applicable and owned; implementation is not complete
Implemented	Signal exists; acceptance or operating verification is incomplete
Verified	Acceptance criteria passed and evidence is retained
Gap	Required outcome is not met or evidence is unreliable
Waived	A permitted, approved, and unexpired waiver exists
Not applicable	The requirement's subject does not exist in the approved scope; the testable fact, reviewer, and reassessment trigger are recorded. This is a playbook status, not an ORF matrix action.

2. Requirement status overview

Keep this table short. Put implementation and test detail in the record below.

ORF ID and obligation	Status	Owner	Latest evidence	Next review
Example: ORF-AGT-04; Mandatory	Verified	Platform observability lead	Propagation test EV-1042; coverage query Q-17	2026-11-01 or service-boundary change
Example: ORF-PERF-07; Good-to-Have	Planned	Model assurance lead	Dataset approval dependency GOV-88	2027-Q1
Enter: ORF-___; matrix action	Select: status above	Enter: one accountable role	Link: latest test/query/case reference	Enter: date and trigger

3. Detailed requirement evidence

Create one record per selected ORF ID. This two-column structure replaces the unreadable nine-column table.

Example — ORF-AGT-04

Field	Evidence record
Requirement and obligation	ORF-AGT-04; Tier 2 trace; Mandatory for this High-Risk system
Applicability and use	Multi-service material journey; used for incident reconstruction and trace-coverage monitoring
Implementation/schema	W3C trace context; span contract trace-contract-v3; gateway, retrieval, model, guardrail, and tool producers
Dashboard/query	Trace coverage dashboard D-04; missing-producer query Q-17
Acceptance evidence	Normal, asynchronous-boundary, retry, timeout, and missing-context tests; result EV-1042, 2026-08-20
Evidence quality	99.97% coverage in test; schema-validity 100%; no restricted content in general trace
Owner and operation	Platform observability lead; alert below 99.5%; runbook RB-TRACE-01
Issue/waiver	None; Mandatory items cannot be waived
Next review	2026-11-01 and on gateway, service-boundary, or collector change

Copy for each selected ORF ID

Field	What to enter
Requirement and obligation	Enter: ORF ID, tier/type, matrix action, and register link
Applicability and use	Describe: system fact and operational/assurance decision supported
Implementation/schema	Link: event, span, metric, dashboard, control, or review contract and version
Dashboard/query	Link: stable view or saved query; state expected interpretation
Acceptance evidence	Link: test/exercise, date, environment, release, result, and reviewer
Evidence quality	Record: coverage, validity, freshness, sample size, and known limitations
Owner and operation	Enter: accountable owner, threshold/cadence, alert route, and runbook
Issue/waiver	Link: defect, permitted waiver, compensating control, approver, and expiry—or None
Next review	Enter: date and change/reassessment triggers

4. Waiver record

Do not use this section for Mandatory items. A waiver is valid only where the matrix permits it.

Field	Record
Requirement and matrix obligation	Enter: ORF ID and confirm “Mandatory but Waivable”
Underlying risk	Describe: failure or harm the requirement addresses
Reason and duration	Explain: why implementation is not currently feasible/proportionate and for how long
Residual impact and likelihood	Record: approved assessment and assumptions
Compensating controls and evidence	Link: controls, tests, monitoring, and operating evidence
Remediation	Enter: deliverable, owner, due date, and success criteria
Approval	Enter: authority, decision, effective date, and expiry date
Reassessment triggers	List: changes or events that invalidate the waiver early

5. Verification history

Date and scope	Test or exercise	Result and evidence	Defects/actions	Reviewer
Example: 2026-08-20; release 2.4	Trace propagation and exporter-loss exercise	Pass with action; EV-1042	Add queue-boundary test; OBS-231	Platform assurance
Enter: date, release, environment	Describe: acceptance, incident, review, or exercise	Select: Pass / Fail / Conditional; link result	Link: action, owner, due date	Enter: independent reviewer

Next: use verified evidence in the implementation-readiness checklist and periodic reviews.