--- content_id: WACK-CONTENT-0065 library_id: WACK-CASEFILES-0001 channel: web-long-read related_concept_ids: [WACK-CONCEPT-0019, WACK-CONCEPT-0016, WACK-CONCEPT-0015] field_manual_content_id: WACK-CONTENT-0059 publication_status: ready claim_class: editorial_composite technical_review: not_required verified: 2026-09-03 --- # One Screenshot, Ten Controls, Zero Owners > The evidence was copied so efficiently that nobody remembered what the original result had been created to prove. _Fictional composite synthesized from common practitioner patterns; it does not describe a client, assessment, or incident. Practitioner education, not PCI SSC terminology or a compliance determination._ By the time the screenshot reached control number ten, it had three filenames, four captions, two different dates, and no living owner. ## The scene The screenshot began as a sensible piece of evidence. A system owner captured a configuration view, added a date, and placed it in the request folder. It clearly showed one setting for one platform. The evidence coordinator noticed that several control descriptions mentioned the same general capability and reused the image rather than asking the owner for nearly identical artifacts. Reuse looked like maturity. It reduced requests, saved time, and kept the package consistent. Over successive cycles, however, the image traveled farther. One team cited it for configuration. Another cited it for coverage. A third cited it for review. An acquired environment used the same control name, so the screenshot joined that narrative too. The picture stayed still while the claims multiplied around it. ## The caption expansion Each copy acquired a new caption. Platform setting enabled became control configured. Control configured became all systems covered. All systems covered became operating effectively. The words changed because every consumer needed the evidence to answer a slightly different question. No one intended to overstate the image. The repository simply lacked a declared claim boundary. When a reviewer asked for the population, the team opened the screenshot. It showed a console name but no tenant, account, scope filter, or export. The original owner had moved to another role. The person who captured it could remember the screen but not the query. Evidence Echo had reproduced the artifact more reliably than the organization had preserved its meaning. ## The control doppelgängers The deeper review found that the shared control name covered three different implementations. The primary platform used a centralized setting. The acquired environment used a local configuration. A legacy service relied on a manual review. The narratives used the same title, but owner, population, frequency, method, and evidence differed. The screenshot had hidden the divergence because it looked familiar in every folder. Reuse created the appearance of standardization without the operating facts of a standard control. Nobody owned the combined claim because nobody actually operated the combined control. Ownership Fog was not a missing name in a spreadsheet; it was a control model that existed only in documentation. ## Building lineage instead of copies The team gave the artifact a source record: creator, system, environment, capture method, timestamp, population, claim, limitations, reviewer, and retention location. Every downstream use linked to that record and declared the narrower statement it relied on. Where the source could not support the claim, the consumer needed different evidence. Then the team separated the doppelgängers. Three implementations received distinct IDs and owners. A common control objective could remain, but each operating variant carried its own population, method, frequency, and evidence path. The repository contained fewer copies and more relationships. Reuse became intentional because lineage made its limits visible. ## What the team finally saw Evidence Echo becomes dangerous when artifact reuse is separated from claim ownership. The file survives, but its population, timing, method, limitations, and original purpose fade. Control Doppelgängers benefit from the confusion because a shared title makes different implementations look interchangeable. The cure is not to ban reuse. It is to preserve evidence lineage and require each consumer to state exactly which claim the source supports. ## The way out ### Find Choose the evidence file referenced by the most controls or narratives. Inventory every copy, filename, caption, control mapping, and decision that currently depends on it. ### Map Trace the artifact back to creator, system, environment, method, population, timestamp, and source data. Trace it forward to each consuming claim and identify where the meaning expands. ### Explain Name an owner for the source artifact and an owner for every downstream claim. Distinguish control objective from operating implementation so shared names do not erase material differences. ### Reduce Replace duplicate files with governed references, split unsupported claims, retire stale copies, and create separate evidence for distinct implementations. Reuse only when the source claim boundary matches the consumer. ### Prove Keep the lineage record, immutable source, review decision, claim mappings, limitations, and refresh trigger together. A future user should know why the evidence exists before deciding where it can be reused. ## Field notes - Evidence reuse is efficient only while its claim boundary remains visible. - A shared control title does not prove a shared implementation. - The artifact owner and the claim owner may be different people; both must exist. - Fewer copies with stronger lineage beat a perfect folder full of echoes. ## What changed The famous screenshot ultimately supported two narrow claims, not ten broad ones. Four consumers switched to query exports with explicit populations. Three received evidence from different implementations. One narrative was rewritten because the supposed combined control did not exist in operation. Two mappings disappeared entirely. The evidence package grew slightly larger and became dramatically easier to defend. When someone reused a record, the system displayed its scope and limitations before the download button. The organization preserved the benefit of reuse without letting repetition manufacture certainty. **The next useful question:** Find the most reused evidence file in your program and map every downstream claim before allowing one more copy.