To organize security evidence, you need exactly three things: one folder structure nobody else gets to invent a second version of, one file naming pattern applied without exception, and the habit of filing each record on the day the work happens rather than months later. Everything else about evidence management is a variation on those three. The reason people find this hard is not the structure, it is that the collecting gets postponed.
Two sentences of framing first. Nothing here says whether any record satisfies anything, and nothing here tells you what records you are obliged to keep. Which frameworks, standards and obligations apply to an organization varies by organization, by industry and by jurisdiction, and determining which ones apply to you belongs with a qualified professional who knows your situation. This article is about filing.
What counts as a dated record
Evidence is a record that something happened, at a knowable time, produced by the work itself. Three properties matter, and a record missing any one of them is weak.
It has a date on its face. Not a file system timestamp, which changes when the file is copied, but a date visible inside the record: the date printed on an exported list, written on a signed sheet, or stamped in a dated note.
It identifies who or what produced it. A name, a role, or the system the export came from. An anonymous list proves less than the same list with “exported by” written on it.
It shows the thing it is supposed to show, without a covering explanation. If a reader needs a paragraph from you to understand what they are looking at, write that paragraph once and store it with the record permanently.
Common forms worth recognizing as evidence: signed or initialed review sheets, exported lists with a visible date, approval messages, completed forms, dated meeting notes with attendees, and tickets or work items showing who closed them and when. Common things that look like evidence and are not: screenshots with no date in frame, a statement from you that something happens, and a policy document, which describes intent rather than recording an event.
One folder structure to organize security evidence
Pick a structure and make it the only one. The structure matters far less than its singularity, because every competing structure doubles the time to find anything.
A plain arrangement that holds up:
- Top level by subject area, matching your written documents. Access, data handling, vendors, continuity, incidents, training, and so on. The person looking for something thinks in subjects, so the top level should too.
- Second level by year. Not by quarter or month at this level, because most subject areas produce only a handful of records a year and empty month folders make the tree feel abandoned.
- Third level only where volume demands it. Add a quarter or a per-item folder when a single year folder passes roughly thirty files, and not before.
- One
supersededfolder per subject area, for versions replaced by newer ones. - One
indexfile at the top, listing each subject area, who owns it, and what records are expected there each year.
Resist organizing by person, by tool or by whoever requested the records. All three change, and the structure then needs rebuilding. Subject and year both stay stable.
A naming pattern you apply every time
A file name should answer what, when and which version without being opened.
Use subject-record-type-YYYY-MM-DD-vN, lower case, hyphens only, dates always year first so sorting by name sorts by time. For example access-quarterly-review-2026-03-31-v1. Where a record relates to one item, put the item next: vendor-review-northbridge-2026-02-14-v1.
Four rules make the pattern survive contact with real people:
- Never use spaces, and never use a date format that puts the day or month first.
- Never use the word “final,” “latest,” “new,” or “current” in a file name. Versions handle that, and those words always end up attached to the second-newest file.
- Never put a person’s name in a file name unless the person is the subject of the record.
- Never rename a filed record. If it was wrong, file a corrected version and move the original to
superseded.
Write the pattern down in the index file with two worked examples. A pattern that lives only in one person’s head gets applied inconsistently within a month.
Organize security evidence as the work happens, not at the end
This is the whole difference between evidence management that works and evidence management that consumes a month twice a year.
A record created at the moment of the work is accurate and takes seconds to file. The same record reconstructed later is slow to produce, often impossible, and carries a quiet credibility problem because it was assembled after the fact by somebody with a reason to want it to look a certain way.
The practical move is to make filing the last step of the work instead of a separate project. Each of your control documents already names an output and a record location. Add the filing to the end of the procedure, so the quarterly review is not finished until the sheet is signed, named and dropped in the folder. Nothing gets a tidy-up pass later.
| Collected as work happens | Reconstructed later |
|---|---|
| Dated the day of the work | Dated the day of the search, or undated |
| Takes seconds per record | Takes days per subject area |
| Complete because nothing was skipped yet | Full of gaps nobody can explain |
| Produced by the person who did the work | Assembled by whoever is free |
| Costs nothing extra | Displaces other work, usually urgently |
Two habits help. Give one person per subject area the standing job of filing, so there is never a question of whose task it was. And put a short monthly check in the calendar: open the index, look at what records were expected this month, confirm they are there. Ten minutes a month beats the alternative.
Keeping superseded versions
Never delete and never overwrite. When a record or document is replaced, move the old one to the superseded folder in the same subject area, keeping its original name, and add the version number to the new one.
The sequence of versions is itself informative in a way no single current version can be. It shows a process that has been run repeatedly rather than built once. It also protects you from the awkward situation where somebody asks about a state of affairs from eighteen months ago and the only copy you have is the current one.
Set a retention period per subject area in the index, note it, and keep records that long at minimum. Decide that once, write it down, and stop re-deciding it per record.
What a well-ordered evidence folder does not do
Filing records well does not establish that the underlying work was sufficient, does not satisfy any requirement by itself, and is not a credential or an outcome of any kind. A well-organized folder of records is a well-organized folder of records. Whether those records answer what somebody is asking is their judgment, informed by a qualified professional who knows your context, not a conclusion you can reach from the tidiness of the structure.
What good organization does give you is narrower and genuinely valuable. You can find any record in under a minute. You can see what is missing before somebody else points it out. And you never again spend a week reconstructing the last twelve months from memory and inbox searches, which is the actual cost that bad filing imposes, paid in full every time.
Build the structure before you need it, because the version you build under pressure is always the worse one. To see which records each of your written documents should be producing, and in what order to set the folders up, work through the Trust Center Document Checklist page on this site.