Draft
Evidence vs attestation in security reviews
By The Citesheet team · Published
Short answer
Evidence is anything that shows a control is in place: a policy sentence, a configuration screenshot, a log, a ticket. An attestation is a formal statement by an independent party, such as a CPA firm's SOC 2 report or an ISO 27001 certificate, that specified requirements have been met. Questionnaire answers are self-reported claims, and buyers trust them more when each one points to evidence.
Security reviews mix three kinds of statement, and it helps to keep them apart.
Self-assessment
A self-assessment is what you say about yourself. A filled-in security questionnaire is a self-assessment. So is a CAIQ published at the CSA's STAR Level 1, where "organizations submit a self-assessment" (CSA).
Evidence
Evidence is anything that shows a claim is true: a sentence in an approved policy, a configuration screenshot, an access review ticket, a log extract, a pen test summary. Evidence turns a self-assessment from "trust us" into "check for yourself." In a questionnaire, the strongest answers cite it directly ("See Access Control Policy, section 3").
Attestation
An attestation is a formal statement by an independent party. NIST's glossary, citing ISO/IEC 17000, defines attestation as "the issue of a statement, based on a decision, that fulfillment of specified requirements has been demonstrated" (NIST). In security reviews the common ones are:
- a SOC 2 report from a CPA firm (part of the AICPA's SOC suite)
- an ISO 27001 certificate from an accredited certification body
- CSA STAR Level 2, where organizations "earn a certification or third-party attestation" (CSA)
Why the difference matters
An attestation carries more weight, but it costs time and money, and a young company may not have one. Evidence is what you can offer now. That's the idea behind Citesheet: every answer points to the exact sentence in your own documents that supports it, so the reviewer can check it, and where there is no such sentence, the answer says so. See our CAIQ control pages for examples of evidence for real controls.