Evidence Decay Rate

Evidence Decay Rate is the speed at which compliance evidence loses validity after collection. A screenshot of an access review is stale the moment permissions change; a policy PDF is outdated when the org chart shifts. Agencies that treat evidence as a one-time deliverable watch audit costs climb as auditors request fresh samples. Those that instrument continuous collection turn decay into a managed variable. The framework asks: for each control, how fast does proof expire, and what is the cost of re-collection? High-decay controls (user access, infrastructure config) need automated monitoring; low-decay controls (policy sign-off) can be batched. Platforms like Vanta and Drata pull real-time data from AWS, Okta, and GitHub, shrinking the re-collection window. Sprinto extends this to 200+ frameworks, but each added framework introduces new decay curves. Agencies that map decay rates per client can price retainers around monitoring frequency rather than audit events, converting a reactive cost into a predictable line item.