Evidence and ConMon Plan
Continuous monitoring is the operating model after authorization and the best readiness model before authorization. Build evidence production into normal engineering workflows so the monthly package is assembled from artifacts that already exist.
Evidence Principles
- Prefer machine-readable evidence over screenshots.
- Preserve source artifacts, not only dashboards.
- Tie each artifact to a control family and owner.
- Store evidence in a durable location with retention and access control.
- Review evidence on a fixed cadence and create POA&M items for gaps.
Monthly ConMon Package
| Package Item | Contents | Owner | Source |
|---|---|---|---|
| Executive status | Control posture, high-risk findings, open POA&M count, significant changes. | Security | ConMon review issue |
| Inventory | Systems, services, containers, dependencies, external connections. | Platform Engineering | CMDB or generated inventory |
| Vulnerability scans | OS, container, dependency, web app, database, Kubernetes, IaC findings. | Security | Trivy, Grype, ZAP, OpenSCAP, kube-bench, Semgrep |
| POA&M update | Open, closed, overdue, risk-accepted, and newly discovered items. | Security | POA&M register |
| Change summary | Production releases, emergency changes, configuration changes, rollback events. | Platform Engineering | GitHub, Argo CD, release records |
| Access review | Privileged users, service accounts, group changes, break-glass events. | Security | IdP, GitHub, Kubernetes |
| Incident summary | Security incidents, alerts, investigations, exercises, lessons learned. | Operations | Incident tracker and alert history |
| Backup and restore | Backup job status, restore-test evidence, DR changes. | Operations | Backup tooling and runbooks |
| Audit log review | Alert rules, audit event health, retention status, notable events. | Operations | Log platform and SIEM |
Evidence Catalog
| Evidence | Supports | Frequency | Retention | Storage |
|---|---|---|---|---|
| Pull request approvals | CM-3, CM-4, AC-5, SA-10 | Per change | [FILL IN] | GitHub |
| Branch protection export | CM-5, AC-5, SA-10 | Monthly | [FILL IN] | Evidence repository |
| CI workflow logs | SA-11, SI-2, CM-3 | Per build | [FILL IN] | GitHub and artifact store |
| SARIF scan results | RA-5, SA-11, SI-2 | Per build and monthly | [FILL IN] | GitHub security and evidence store |
| SBOM | SR-3, SR-4, CM-8 | Per release | [FILL IN] | Artifact registry |
| Provenance attestation | SR-4, SA-10, CM-3 | Per release | [FILL IN] | Artifact registry |
| Signed container image | SI-7, SR-4, CM-5 | Per release | [FILL IN] | Container registry |
| Argo CD sync history | CM-3, CM-4, CM-6 | Per deployment | [FILL IN] | Argo CD and evidence export |
| Kubernetes policy report | CM-6, SC-7, SI-7 | Continuous and monthly | [FILL IN] | Cluster and evidence store |
| Access review issue | AC-2, AC-6, IA-2 | Quarterly or monthly for privileged access | [FILL IN] | GitHub Issues |
| Audit log retention export | AU-9, AU-11, AU-12 | Monthly | [FILL IN] | Log platform |
| Backup restore test | CP-9, CP-10 | Quarterly or after major changes | [FILL IN] | Evidence repository |
| Incident exercise record | IR-3, IR-4, IR-8 | At least annually | [FILL IN] | Evidence repository |
Monthly Workflow
- Open a dated ConMon issue.
- Attach generated scan reports and inventory exports.
- Review open findings against remediation windows.
- Create or update POA&M items for findings that cannot close in time.
- Confirm access, backup, incident, and audit-log evidence.
- Record significant changes and decide whether AO notification is needed.
- Approve the ConMon issue with Security and Platform Engineering sign-off.
- Store the final package in the evidence repository.
Significant Change Triggers
| Trigger | Review Needed | Evidence |
|---|---|---|
| New production region | Boundary, data residency, inherited controls, DR | Architecture review and provider evidence |
| New external integration | Interconnection, data flow, vendor risk | Vendor review and data-flow update |
| New identity provider or auth flow | IA, AC, privacy, audit | Auth design review and test evidence |
| New database or storage class | SC, CP, privacy, retention | Encryption, backup, and retention evidence |
| Major Kubernetes policy change | CM, SC, SI | Policy review and test results |
| Encryption or key-management change | SC | Crypto review and key-management evidence |
ConMon Definition of Done
- All required monthly evidence is attached or linked.
- Scan findings are triaged by severity.
- POA&M items are created or updated.
- Overdue items are escalated.
- Significant changes are reviewed.
- Access-review exceptions are tracked.
- Backup and audit retention status is confirmed.
- Security and Platform Engineering sign off.