When a DORA major incident must be reported, what each of the three reports contains, who receives them, and a template to prepare before you need it.

A management-led check before the auditor starts: how to find gaps and exceptions, fix them, and decide when to begin the observation period. Decide what the report is for. Draw the boundary around ...

Structured handover from an outgoing leader covering open risks, incidents, commitments, suppliers and access. The document from section 1, as you will receive it. Highlighted [[text]] is for you to ...

Pre-emptive security overview that answers the common questions before a questionnaire is sent. The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded ...

Specifies requirements for LLM applications covering input handling, output validation, data exposure, logging and agent permissions. An LLM application puts instructions and data in one channel. The ...

States permitted AI uses, prohibited uses, data rules and accountability; the AI domain's single policy. Most organisations do not build AI. They use other people's AI: an assistant inside the office ...

Gives each DORA article's own text, what an entity must be able to show and the CISO Times documents that help. It maps nothing to ISO 27001 or NIST CSF (D-51). The workbook's sheets as you will ...

Structure for the documented ICT risk management framework, including its review and approval record. The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; ...

Templates for notification to the supervisory authority and communication to affected data subjects. These templates hold the words of every notice a personal data breach can need under the GDPR: the ...

Purpose This procedure sets out how [ [Organisation Name]] runs its backups day to day and proves that they restore. It has three routines: the daily review of backup jobs, the handling of a failed ...

Assigns decision authority, drafting, legal review, submission and follow-up reporting for each regime. This procedure gets an incident's reports to the authorities made correctly and on time: to the ...

It applies the Business Continuity & ICT Resilience Policy and runs each service's recovery plan, written with the Cyber Recovery Plan Template. It starts once the incident response of the Security ...