---
title: Controls and Evidence Pipeline
description: Build preventive and detective controls with continuous evidence generation for audits, governance reporting, and incident analysis.
sidebar:
  label: Controls and Evidence Pipeline
  order: 13
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/controls-and-evidence-pipeline/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/controls-and-evidence-pipeline.mdx"
---

## Purpose

This module defines how controls are enforced and how evidence is generated automatically for compliance and audit use cases.

## Control categories

- **Preventive controls**: Guardrails that block non-compliant changes before deployment.
- **Detective controls**: Monitoring controls that identify deviations and suspicious behavior.
- **Corrective controls**: Response controls that contain and resolve incidents.

## Evidence pipeline model

- **Source layer**: Collect audit events, platform telemetry, and workload observability data.
- **Normalization layer**: Standardize and enrich records for policy and reporting.
- **Retention layer**: Apply retention and access policies aligned with compliance obligations.
- **Reporting layer**: Provide control status and evidence extracts for governance and audit.

## STACKIT references

- **Audit Logging**: <LinkChip href="https://docs.stackit.cloud/platform/audit-log/">Documentation</LinkChip>
- **Telemetry Router and Logs**: <LinkChip href="https://docs.stackit.cloud/products/logging-and-monitoring/telemetry-router/basics/overview/">Basics</LinkChip> and <LinkChip href="https://docs.stackit.cloud/products/logging-and-monitoring/logs/basics/introduction-to-logs/">Introduction To Logs</LinkChip>
- **Observability**: <LinkChip href="https://docs.stackit.cloud/products/logging-and-monitoring/observability/">Documentation</LinkChip>

## Anti-patterns to avoid

- **Evidence by spreadsheet**: Manual and inconsistent evidence handling across teams.
- **Disconnected telemetry**: Audit, platform, and application signals cannot be correlated.
- **No recurring verification**: Controls are declared effective without periodic validation.