Evaluate third-party evidence for relevance, reliability, scope, freshness, and support, then record control conclusions and follow-ups without deciding risk acceptance. Use when reviewing questionnaires, assurance reports, certifications, policies, test summaries, resilience exercises, or vendor responses.
