Audit evidence is the records, system observations, and test results used to prove that a control works in practice. In cyber security, this can include logs, configuration snapshots, access reviews, tickets, screenshots, alerts, drill results, and change records. The key point is that evidence shows not just what a policy says, but what the system actually did.
It matters because many security failures hide behind well-written documentation. Attackers benefit when controls exist only on paper, while defenders use audit evidence to confirm that monitoring, patching, backup, and incident-response controls are functioning. During an audit, evidence may come from live system checks, sampled accounts, or recorded traces of suspicious activity. Good evidence is timely, authentic, and traceable, making it harder to fake compliance and easier to spot weak controls.