Guides to privacy and security documentation

Before answering a single question — which standard it is, what is in scope, which of the client's documents answer which section, and how to handle the controls the client does not have.

The questions that separate a provider from a deployer, a minimal-risk system from a high-risk one, and what to document before the deadlines.

A method for answering questionnaires from a client's documented facts, marking what needs checking and building a reusable answer library.

What the Cloud Security Alliance's short questionnaire asks, what Yes, No and N/A mean in version 4.1, who owns each control, and how to answer from the client's documents without overclaiming.

Article 33(5) requires a record of every personal data breach, reported or not. The fields that record needs, the deadlines it runs against, and a template to copy.

What breaks between 10 and 40 clients, and the operating habits that keep documentation current without hiring for every new engagement.

Where member states diverge on scope, registration and incident reporting, and how to advise a client operating in several of them.

Two standard vendor questionnaires, two different owners and licences. What each covers, who asks for which, and how to answer both from one set of documents.

Which vendor changes require a client update, which only need a note on file, and how to track them across a portfolio.