agent's compliance evidence export missed the retention window: how to recover
Recovers missed compliance evidence exports with backfill and window monitoring. Use when an export misses its retention window. Key trigger: evidence gaps in the retention window.
agent's compliance evidence export missed the retention window: how to recover
TL;DR
The evidence export ran late and the source's retention had already aged out the data, leaving a gap. Backfill what survives from replicas and archives, document the gap honestly, and monitor export freshness so the next run cannot miss the window. Retention windows do not negotiate.
compliance evidence export missed the retention window (gap in evidence)Steps
Measure the gap: which time range is missing from the evidence store. Expected: The gap is bounded.
Backfill from every surviving source: replicas, archives, provider exports. Expected: The gap shrinks to what is truly gone.
Document the unrecoverable portion honestly for the auditor; invented evidence is worse than a gap. Expected: The record is truthful.
Fix the export scheduling: run it well inside the retention window with freshness monitoring. Expected: Exports cannot miss the window.
Alert on export age: if the newest evidence is older than the threshold, page. Expected: Staleness is visible immediately.
When to use
- evidence exports miss retention windows
- compliance gaps appear
- source retention is short
When not to use
- the data is fully backfilled (then it is a scare, not a gap)
- retention was extended before the miss (check the actual window)
- the evidence was never required (confirm with the auditor)
Tool compatibility
- any compliance evidence pipeline
- retention-windowed sources
Variant phrasings
- "evidence export missed retention window"
- "compliance evidence gap recovery"
- "retention window missed export"
Why it happens
Sources keep data for a fixed window, and evidence pipelines that run late lose the oldest data permanently. The export schedule and the retention window are a coupled system; when the schedule slips past the window, data is gone, not delayed. Freshness monitoring is the coupling made explicit.
Edge cases
- backfilled evidence must be labeled as such; auditors distinguish
- the honesty of the gap report matters more than the gap
- retention windows differ per source; the tightest one sets the schedule
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_EERq2aG6iDlrTAh9FVTUVg