Evidence is the substrate, not an attachment.

Every material claim should be traceable to a source, timestamp, asset/version, provenance, verification state and freshness. Evidence can be reused across Assurance, Compliance, Vendor Risk, Supply Chain and operational domains.