Upload, link and review an evidence version

Before you begin

• Select the correct Active client and Active program. Have the exact file to review and know its applicable requirement and period.
• Use an account authorized to upload and review evidence. A reviewer must assess the file itself; a hash check is not a sufficiency decision.

1. Upload a file into Evidence

1. Open Evidence or Evidence Vault, depending on the active navigation view. Confirm the client/program at the top.
2. Choose the Framework requirement, enter a descriptive Evidence title and record context in Notes. Example: “Privileged account review — October 2026”; include the actual owner and review period in your notes.
3. Click Upload Manual Evidence and select the file. Wait for the upload to finish, then locate its row in the evidence list.
4. Select the retained version and click Open Selected Version. Confirm that the content is the intended file. Click Verify SHA-256 to verify its retained bytes.
5. When replacing evidence later, select the evidence record and use Upload New Version. Review and link the intended new version explicitly; do not assume every prior requirement link now refers to it.

2. Link the exact version to a requirement

1. Open the active program’s requirements workspace and select the requirement row. The page name follows the framework, such as CMMC Requirements Workspace.
2. Under Link evidence version, select the desired item in Evidence version to link. Use Preview selected evidence to confirm its content.
3. Click Link selected version. Alternatively, Upload & link evidence uploads and links a new file directly from this workspace.
4. Select the resulting entry in the linked-evidence list. Use Review linked evidence to record sufficiency; do not treat the Evidence sufficiency display as a substitute for the review dialog.

3. Save a sufficiency decision

1. In Review linked evidence, check the displayed requirement and file/version identity. Open or preview that exact version before choosing a decision.
2. Enter Reviewer name. In Decision, choose Mark Sufficient, Request Changes or Reject.
3. In Reason, write 20–4000 characters explaining the basis. For example: “Reviewed the October access-review export for all 12 in-scope administrators; the reviewer sign-off and two resolved exceptions are included.” Use facts from your actual review, not this example.
4. Select I reviewed this exact version and its relevance, scope and freshness. Click Save review.
5. Return to the requirement and confirm the linked evidence reflects the saved decision. Complete the remaining workpaper, sampling, independent approval and findings checks separately.

If something goes wrong