I have been trying to gain an understanding on what specific artifact/evidence that should be requested per specific selected controls. To include tailored questions that can be used as a guide to gather information for writing implementation statements.

Background: Currently going through my first full start to finish RMF process for ATO. I am assisting ISSO’s, ISSM’s, and other stakeholders with writing the control implementation statements while also gathering artifacts/evidence. The system has 15 components and 188 controls we are working on writing implementation statements per each component. With that comes with meeting with the appropriate POC per components and interview them to gain knowledge on the processes and how these components are being used in the main system.

Does somebody have some sort of guide for internal auditing? Maybe an artifact request list?