history Last updated

Compliance artefacts are evidence, so they are written to survive an auditor reading them a year later with no access to you. Each template records the decision, the date, the person accountable, and the evidence — the four things an audit finding is usually missing.

Linked from

  • Access Review — Periodic recertification of who has access to what — and the evidence that someone actually looked.
  • Architecture & Design — Architecture documents, decision records, API specs and data models.
  • Data Protection Impact Assessment — Structured analysis of privacy risk before processing starts — necessity, proportionality, and what you will do about the risks.
  • Information Security Policy — Mandatory rules with named owners, written so people can actually comply with them.
  • Operations & Incident — Runbooks, incident reports, postmortems, change requests and on-call handovers.
  • Overview — Copy-paste document templates for IT work, each with a worked example and the mistakes that usually spoil it.
  • Risk Register — Standing organisational risks with owners, treatment decisions, and dated reviews.
  • Vendor Security Assessment — Due diligence on a third party, scaled to what they will actually hold and do.