Evidence is the data that defines whether an asset in an enterprise is configured, managed, and secured as per the governance requirement. Validation checks are run on assets and the information that provides data after a validation check passes or fails on an asset, is called evidence. Evidence information that is collected from a validation check failure is known as negative evidence. Positive evidence information contains more data about the asset on which a validation check passes.

The Evidence Management is an independent system that collects evidence for any application through an evidence provider. An evidence provider is a CSV file that contains the evidence data of the application. Control Compliance Suite lets you collect and report evidence data by scheduling an evidence collection job through the console. You can also configure the retention age of the evidence data in the evidence database of Control Compliance Suite.