The argument
Trace Evidence Lineage Before One Screenshot Becomes Ten Controls
An evidence-lineage map starts with the original artifact and collection method, records its system, population, period, owner, and limitations, then shows every control claim that relies on it and the supplemental evidence needed when one artifact cannot support the whole story.
The field pattern
A configuration export appears in an access review, hardening review, monitoring control, change record, and assessment workbook. Each citation has a different filename and control label. All five point back to the same point-in-time collection from one account. The reuse may be valid for some claims, but the five references are not five independent observations.
Why it matters
Evidence reuse can reduce effort and improve consistency when each use states the claim, scope, period, and limitation it supports. The problem is evidence multiplication by reference: repeated citations create the appearance of corroboration while retaining the same blind spots and collection boundary.
Lineage also improves corrections. When an artifact is incomplete, superseded, or wrong, the team can identify every dependent claim and regenerate the affected derivatives instead of discovering the reuse one control folder at a time.
Questions that expose the Wack
- What is the original artifact, and how, when, from where, and by whom was it collected?
- Which population, systems, configurations, and time period does it actually represent?
- What distinct claim does each reuse support, and what limitation carries forward with it?
- Which claims need independent or supplemental evidence rather than another link to the same source?