When a DORA major incident must be reported, what each of the three reports contains, who receives them, and a template to prepare before you need it.

Structured handover from an outgoing leader covering open risks, incidents, commitments, suppliers and access. The document from section 1, as you will receive it. Highlighted [[text]] is for you to ...

Pre-emptive security overview that answers the common questions before a questionnaire is sent. The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded ...

Runs a questionnaire from receipt through answer reuse, SME input, approval and submission. The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded ...

Contract exhibit stating the security commitments the organisation offers by default. A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what ...

Specifies requirements for LLM applications covering input handling, output validation, data exposure, logging and agent permissions. An LLM application puts instructions and data in one channel. The ...

Why an index. A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point ...

States permitted AI uses, prohibited uses, data rules and accountability; the AI domain's single policy. Most organisations do not build AI. They use other people's AI: an assistant inside the office ...

Reviews what tools, data and actions an AI agent can reach and whether a human approves high-impact actions. 1 Use this workbook with the Generative AI Security Standard and the LLM Application ...

Domain-by-domain maturity questionnaire returning current level, target gap and prioritised next actions. 1 Before scoring, the sponsor approves a target level and its reason for every domain (MA-09).

Templates for notification to the supervisory authority and communication to affected data subjects. These templates hold the words of every notice a personal data breach can need under the GDPR: the ...

Structured decision tree for whether an incident is significant, major or notifiable, with the reasoning recorded. This model decides, for one declared incident, whether a report to an authority is ...