ISSA-COS October 2026 Chapter Meeting

Beyond the Checklist: From Compliance Claims to Verifiable Evidence

A policy describes what should happen. A checklist records what someone says happened. What evidence would convince an independent reviewer?
This session explores how to move from compliance documentation to traceable, trustworthy evidence of security practices. Using examples relevant to public-sector organizations and their contractors, David will examine how to connect requirements, implemented controls, and operational activity into an evidence trail that supports meaningful assessment.
Topics include continuous evidence collection, tamper-evident records, and AI-assisted workflows that preserve confidentiality and accountability. The discussion will also distinguish what cryptographic verification can establish about an artifact from what it cannot establish about the effectiveness of a security control.
Attendees will leave with practical questions for evaluating compliance evidence: Where did it come from? Is it current? What does it actually demonstrate? What remains unproven?s configure the rules in one readable place rather than building them into every agent.