What it does
A control that passed a scan eight months ago is not the same as one verified last week — but a plain pass/fail view renders them identically. Evidence Freshness (TATER Security → Evidence → Evidence Freshness) looks at when each control was last evidenced and buckets the whole register by age:
| Bucket | Meaning |
|---|---|
| Fresh | Evidenced within the last 90 days. |
| Aging | Most recent evidence is 90–180 days old — still usable, plan a refresh. |
| Stale | Older than 180 days. Most audit programs will not accept it as current. |
| No Evidence | Nothing on record has ever evaluated this control. This is not a pass and not a fail — it is an unanswered question, and it renders as its own bucket so it can never hide inside a healthy-looking average. |
What counts as evidence
The freshness date for a control is the newest of:
- A scan that evaluated it — automated cloud or endpoint scans, whichever ran last.
- A recorded risk acceptance — the date the acceptance was made.
- A manual verification — the date a person attested the control by hand.
Acceptances and manual verifications carry review dates. Evidence Freshness surfaces any that are expiring within 30 days or already expired — an expired acceptance is a control silently running without its documented justification.
Working the page
- Open the page before an audit window (or monthly, as hygiene) and start from the Stale and No Evidence buckets.
- For a stale automated control, re-run the relevant scan or trigger its remediation — the next evaluation refreshes the date.
- For a stale manual control, re-verify it (Controls → Verify manually) so the attestation date moves.
- Renew or retire anything in the expiring-acceptances list — do not let an acceptance lapse in place.
Automation & MCP
The same data is available to your AI assistant via the list_evidence_freshness MCP tool, which returns the buckets and the expiring/expired acceptance list — useful for a weekly “what needs re-evidencing” digest, chained into trigger_remediation or verify_manual_control.
Related
- GRC guide — risk acceptances and exceptions.
- Running scans — refreshing automated evidence.
- Audit snapshots — where point-in-time evidence lands for an auditor.