# Evidence Skills Checklist

North Star Security

Proof of work needs evidence - not vibes. Use this checklist to prepare cybersecurity evidence for reports, portfolio projects, lab writeups, and interviews.

## 1. Evidence packet cover sheet

**Question, alert, finding, or project objective:**
**System, user, source, or asset scope:**
**Evidence date or period:**
**Analyst / student:**
**Status:** Complete / Partial / Unverified / Needs follow-up

## 2. Evidence quality checklist

For each investigation, lab, finding, or portfolio claim, collect:

- Screenshot, export, report, command output, log sample, or ticket
- Date captured or reporting period
- System, user, source, asset, or scenario scope
- What the evidence proves
- What remains unknown, assumed, or unverified
- Recommended next step or validation action
- Portfolio-ready summary, report section, or interview story note

## 3. Common evidence examples

| Practice area | Possible evidence |
|---|---|
| SOC investigation | Alert details, auth logs, timeline, affected user/asset |
| Vulnerability writeup | Scanner output, version details, proof, remediation note |
| Mini-range lab | Scenario prompt, screenshots, log excerpts, final report |
| Portfolio project | Objective, tools used, findings, evidence, lessons learned |
| Interview story | Work performed, conclusion, evidence, impact, next step |

## 4. Evidence note template

> This evidence supports [question/finding] for [scope]. It was captured on [date] from [system/source]. It shows [what the evidence proves]. Current limitations are [unknowns/assumptions], with next validation step [action].

## 5. Red flags

- Screenshot has no date or context
- Evidence does not match the question
- Scope is unclear
- Assumptions are hidden
- Claim is stronger than the evidence supports
- Next step is missing

## North Star rule

If you cannot explain what the evidence proves, when it was captured, and what limitation it has, it is not ready for a portfolio, report, review, or interview.