Why Attestation Is Not Assurance
·
An attestation is someone stating that a control is in place. Assurance is independent confirmation that it operates. Most agency compliance programs produce the first, report it as the second, and discover the difference during an audit.
This is not a criticism of agencies. It is a description of what most compliance tooling was built to collect.
Where the distinction comes from
In financial and IT audit practice, an unevidenced management assertion has a defined status: it is a starting point for testing, not a conclusion. An auditor who accepted “management represents that access reviews occur quarterly” as sufficient, without examining the reviews, would have performed no test.
The evidence hierarchy is well established. Independent, contemporaneous documentary evidence outranks internally generated documentation, which outranks observation, which outranks inquiry. Inquiry alone, meaning asking someone whether the control operates, sits at the bottom.
CJIS compliance has historically operated near the bottom of that hierarchy. The policy's modernization moves it up, and the movement is what agencies are feeling.
What the policy now asks for
Three controls carry the shift explicitly.
CA-2 Control Assessments requires assessment of controls, with enhancement CA-2(1) addressing independent assessors. Independence is an assurance concept. It exists precisely because a self-assessment by the party responsible for the control carries less evidential weight.
CA-7 Continuous Monitoring requires ongoing control assessments and ongoing monitoring of metrics in accordance with the monitoring strategy, with established frequencies for both. A frequency requirement is unsatisfiable by assertion. Either the records exist at that frequency or they do not.
CA-5 Plan of Action and Milestones presumes findings exist. A control environment that produces no findings over time is either perfect or unassessed, and assessors have a strong prior about which.
The failure mode this creates in tooling
A compliance platform that asks a user to mark a control as implemented, and then reports a maturity percentage derived from those marks, has measured willingness to click. It has not measured control operation.
This produces a specific and dangerous artifact: a high compliance score generated entirely from unevidenced self-assertion. It is worse than no score, because it substitutes for the assessment that would have found the gap.
Two failure shapes worth naming, because both appear in real assessments.
Absence rendered as compliance. A control that was never assessed is scored as satisfied, usually because the scoring model treats unassessed and compliant as the same nonzero default. The agency sees a green indicator for a control nobody has looked at.
A control present but not applied. The mechanism exists in the environment and is correctly built, and it is simply not applied everywhere it needs to be. The control inventory says it exists. It does. It does not operate on the paths that matter.
Both pass an attestation-based review. Neither survives evidence-based testing.
What actually constitutes evidence
Evidence has properties. Four are worth checking any artifact against.
It is contemporaneous. Generated when the control ran, not reconstructed later. A log entry dated at the time of the access review is evidence. A summary written the week before the audit describing reviews that occurred is testimony about evidence.
It is dated and covers the period. A single current screenshot demonstrates a state today. An assessor examining a twelve-month period needs artifacts spanning that period.
It is attributable. It identifies who performed the control action. An anonymous record does not support accountability, and AC-2's requirement to assign account managers is specifically about attributability.
It is complete for its population. Evidence for three of forty accounts is a sample, and a sample selected by the agency is not the same as a sample selected by the assessor.
Applied to the common controls:
| Control | Attestation | Evidence |
|---|---|---|
| Access review | “We review access quarterly” | Four dated review records for the period, naming the reviewer, listing accounts examined and actions taken |
| Security awareness training | “All staff are trained” | Individual records showing role assignment, role-matched curriculum, completion date, retained three years per AT-4 |
| Vendor oversight | “Our vendors signed the Addendum” | Signed Addenda plus dated triennial audit records per SA-9's monitoring requirement |
| Continuous monitoring | “Logging is enabled” | The written strategy naming metrics and frequency, plus monitoring output across consecutive periods |
The uncomfortable arithmetic for a small agency
A department with fifteen sworn officers, no dedicated IT staff, and a chief who is also the TAC is being asked to produce audit-grade operating evidence across twenty policy areas.
That is a real resourcing problem and no framing dissolves it. Two things make it tractable.
Sequence by the sanctionable set rather than by the full control list. Existing and Priority 1 requirements are the exposure today. Priority 2 through 4 have until September 30, 2027.
Build evidence generation into the control rather than alongside it. A quarterly access review that produces a signed record as a byproduct costs almost nothing more than one that does not. A review conducted without a record has to be reconstructed, and reconstruction is the expensive part.
The question worth asking of any compliance report
Whether it is produced internally, by a vendor tool, or by a consultant, one question separates the useful from the decorative.
For each control marked satisfied, what artifact supports it, and what is that artifact's date.
If the answer for a meaningful share of controls is that someone marked it satisfied, the report describes a set of claims. That is a legitimate input to an assessment. It is not an assessment, and it will not hold up as one.
Written by Dr. Alexis P. Weekes
EDBA-IS · J.M. · CISA · CISM · CRISC · CDPSE
Founder, CJIS360 LLC
Sources: CJIS Security Policy v6.1, 06/25/2026 — AC-2 Account Management; AT-4 Training Records; CA-2 Control Assessments and CA-2(1) Independent Assessors; CA-5 Plan of Action and Milestones; CA-7 Continuous Monitoring; SA-9 External System Services.