Protecting what the business is made of: the systems and data it depends on, the obligations it has taken on, the personal information it holds, the backups it assumes will work, the plans for the days it cannot trade, and the knowledge that currently lives in a few people's heads. One of the core department packs -- trade-neutral, extended by an industry pack. Every worker advises, documents and tracks: it never declares the business compliant, never changes a live system, never gives legal advice, and never becomes the incident response -- anything happening now goes to the people who respond to it.
Included in Starter, Enterprise, Platinum · Version 1.04
Each worker advises, documents and tracks. It never asserts that the business complies with a standard, a law or an insurer's requirement, never performs or authorises a change to a live system, never accesses or moves customer data itself, and never gives legal advice. It sets out what the records show and hands the judgement to the person or the professional who owns it. Anything that looks like an incident in progress goes to the people who respond to it, immediately, not into a document.
Each worker advises, tracks and drafts. Decisions, approvals and anything that commits the business stay with a person.
Keeps the whole picture of what the business must protect and how well it is protecting it. Tracks what has been decided versus what has been done. Prepares the protection story for a board, a client or an insurer. Coordinates the other workers in this pack when something spans more than one area. A director reviews the prepared information to act on exposure.
Analyses advisories and reports against what the business actually runs. Maintains the inventory of internet-facing services, remote access paths and third-party connections. Describes likely attack paths in business terms. Tracks whether known weaknesses have been closed. A person reviews the analysis to prioritise real weak points.
Drafts and revises policies in the business's own language. Maps obligations from contracts, frameworks and industry requirements to current practices. Tracks review dates and prepares answers for client questionnaires or insurer forms. A person or an assessor draws the conclusion about compliance.
Gathers and keeps evidence an auditor, client or insurer will ask for. Maintains the evidence register and tracks what has gone stale. Drafts responses to questionnaires with supporting material identified. Tracks findings and actions from previous audits through to closure. A person decides how to answer a questionnaire when evidence does not fully support.
Tracks personal information the business holds, why it has it and how long it keeps it. Maintains the record of systems holding personal information. Describes who has access to what. Prepares the process for handling individual requests about their own information. A lawyer or privacy adviser answers legal questions about data protection.
Keeps track of what is backed up, what is not and whether a restore has ever actually been proven. Maintains the coverage register of what is backed up and what is not. Records backup outcomes and failures over time. Prompts for tests and reviews that keep the position current. A person with access and authority acts on the prompts.
Maintains the risk register with consequences and current treatments. Drafts continuity plans per scenario and keeps contact and dependency lists those plans need. Runs tabletop walk-throughs and records what they exposed. Tracks insurance cover against identified risks. A person makes decisions about disruptions when they happen.
Identifies knowledge that exists in only one person's head. Prompts for it to be recorded while the person is available. Keeps records findable and organised. Flags material that has gone stale or contradicts newer material. Reports where the business is exposed by what it has not written down. A person decides what is true when records appear wrong or out of date.
