GRC › Module 8 › Lesson 2
Evidence Hygiene
Evidence hygiene literacy — source label, collection date UTC, chain-of-custody stub, redaction note, retention stub — hygiene rows on YOUR `$GRC_LAB` LAB-labeled samples.
Visual · t37_evidence_hygiene
Evidence hygiene = named custody rows. $GRC_LAB LAB samples. Original Cyberlium.
Opening
Audit evidence must be traceable — name collection and custody rows on YOUR LAB samples before submitting forged or mislabeled artifacts for compliance fraud.
Evidence hygiene literacy names: source label category (LAB required), collection date UTC category, chain-of-custody stub category, redaction note category, and retention period stub category. Analyst documents evidence index on `$GRC_LAB` — five LAB-labeled samples from Modules 6–7 with hygiene row each — without mixing stranger org prod screenshots, without backdating collection dates, without unlabeled evidence in audit packs. Cyberlium teaches evidence discipline on YOUR notes. Refused: mislabeled evidence, backdated artifacts, stranger org prod data as YOUR evidence. Lab row: evidence index (five samples, LAB label, UTC, custody stub).
1. Named hygiene rows
Source LAB label, UTC date, chain-of-custody, redaction, retention — five anchors.
Every sample from `$GRC_LAB` templates — not stranger org exports.
Command guide
Try these commands — Named hygiene rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ISO 27001 evidence — https://www.iso.org/isoiec-27001-information-security.html ISACA — https://www.isaca.org/resources/glossary NIST CSF — https://www.nist.gov/cyberframework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export GRC_LAB=${GRC_LAB:-$HOME/cyberlium-lab/t37-grc}
export GRC_EVIDENCE=${GRC_EVIDENCE:-$GRC_LAB/LAB-ORG-001/evidence}
cat > "$GRC_EVIDENCE/evidence-inventory.csv" <<'EOF'
evidence_id,control_ref,description,source,owner,collection_date,retention,label
E-001,PR.AC-1/MFA,IdP MFA policy export (fictional),LAB IdP stub,IT Sec,2026-08-01,3yr,LAB SAMPLE
E-002,A.8.15,SIEM alert tuning ticket (fictional),LAB ticket stub,SOC,2026-08-05,3yr,LAB SAMPLE
E-003,R-001,Access review sign-off (fictional),LAB markdown,CISO,2026-07-15,7yr,LAB SAMPLE
E-004,PCI-10.2,Log review procedure (fictional),LAB doc,Compliance,2026-08-10,1yr,LAB SAMPLE
E-005,RS.MA-1,Tabletop after-action notes (fictional),LAB notes,IR Lead,2026-06-20,3yr,LAB SAMPLE
EOFCommand — copy this
grep -E 'LAB SAMPLE|evidence_id|E-00' "$GRC_EVIDENCE/evidence-inventory.csv" cat > "$GRC_LAB/notes/evidence-hygiene.md" <<'EOF' # Evidence Hygiene — LAB-ORG-001 - Label all lab artifacts: LAB SAMPLE — NOT FOR PRODUCTION AUDIT CLAIMS - Chain of custody: who collected, when, from which system - Integrity: checksum optional for exports; version control for policies - Redact: no real customer PII in evidence pack - Retention: align to policy — fictional dates OK in lab EOF
Command — copy this
grep -E 'LAB SAMPLE|Redact|chain' "$GRC_LAB/notes/evidence-hygiene.md"
Primary tools to practice this lesson: grep, python3. Reference sites: ISO 27001 evidence (https://www.iso.org/isoiec-27001-information-security.html); ISACA (https://www.isaca.org/resources/glossary); NIST CSF (https://www.nist.gov/cyberframework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. LAB label discipline
Gap/evidence = LAB samples labeled LAB — mandatory on every artifact row.
Redaction note documents what was removed — not silent prod data leak.
3. Refused
No unlabeled evidence; no backdated collection; no stranger org data substitution.
Hygiene literacy supports trustworthy packs — not audit fraud.
4. What you ship: evidence index
Five LAB samples + UTC + custody stub + redaction + NEVER unlabeled evidence line.
5. What you record before the next lesson
Evidence index path.
6. Wrong vs right: fraudulent certs vs YOUR lab templates
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Submit stranger org prod screenshot as `$GRC_LAB` evidence without LAB label or redaction.
Right
Evidence index from `$GRC_LAB` LAB-labeled samples. Next: No Forged Artifacts.
Mission: evidence index
1) Name five evidence hygiene rows. 2) Five LAB-labeled samples indexed. 3) UTC and custody stub each. 4) Write NEVER unlabeled or backdated evidence line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Chain-of-custody — minimum literacy stub?”
Knowledge Check
APPLY: Evidence hygiene uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unlabeled evidence belongs in audit packs.
True or False
Knowledge Check
APPLY: Evidence index includes:
Multiple choice