Evidence Half-Life

Evidence Half-Life is the rate at which a collected compliance artifact stops being defensible. A screenshot of an access review is valid the day it is captured and progressively weaker as the underlying system changes: new hires, revoked tokens, rotated keys, a migrated database. Agencies that treat compliance as a one-time certification sprint hand clients a report that decays the moment delivery ends. The framework says to price and staff compliance as a monitoring retainer, not a project, because the artifact with the shortest half-life sets the renewal cadence. Continuous collection platforms such as Vanta, Drata, and Sprinto exist precisely to reset that clock automatically, pulling from AWS, Okta, and GitHub rather than waiting on a quarterly screenshot. The practical test for any agency: for each control, ask how many days pass before the evidence is stale, then match the monitoring interval to the shortest answer. Clients signing security-sensitive contracts will ask for proof at renewal, not at kickoff.