Independent technical practice
Find seven information gathering packages for DFS, New York privacy, CMMC, EAR/ITAR, departed employees, contract disputes and medical matters.
Gather records before an engagement
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export control specialist.
These are preparation aids. They prepare the record for the audit, assessment or specialist decision that follows.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Use the four sector packs, project workbook and shared source records to organize a proposed OT assessment.
File: ZIP: PDFs, XLSX workbook and CSV records.
Keep utility oversight, DFS applicability and private information questions separate while gathering supporting records.
File: ZIP: PDF, XLSX workbook and CSV records.
Gather water, wastewater, electric or gas utility facts, evidence and owner decisions, including 18 tracked open questions.
File: ZIP: PDF, XLSX workbook and CSV records.
Record proposed scope, owners, safety boundaries and permissions before audit, security assessment or physical or cyber testing.
File: Editable CSV preparation checklist.
Browse all preparation packages by subject.
Each overview lists its source dates, scope and open questions alongside the download.
Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Find and organize the records a potential auditor, consultant, attorney or export control specialist will ask for before the first meeting, so that the meeting starts from a record index rather than from memory. Choose a package, send its questions to the people who actually hold the answers and return a record index with its gaps stated explicitly, because a specialist reads the gaps first. Use these packages alongside the existing OT, New York and New Jersey preparation libraries. Professional applicability, evidence sufficiency and specialist acceptance remain separate decisions that the receiving professional makes from what you hand over.
Each package carries a plain language manual, specific gathering requests with the owner to ask and the reason the record matters, an editable checklist, questions for IT and business owners, a blank record index, open questions with responsible roles, handoff checks and source references. The three legal matter packages also carry sample discovery questions for counsel to tailor. The requests are written so that the person holding the record can answer them without interpreting the law, and the checklist is written so that a specialist can see at a glance what exists, what is missing and who is chasing it.
Prepare an organized set of entity facts and existing cybersecurity records for a Part 500 auditor or consultant.
23 NYCRR Part 500 preparation for a potentially covered legal entity. Other DFS examination areas such as financial condition, anti money laundering or transaction monitoring are outside this package.
Find where New York residents information is held and assemble existing safeguards and incident records for a privacy or cybersecurity specialist.
General Business Law 899-aa and 899-bb preparation, with a separate branch for state entities and sector specific obligations. It is not a universal New York privacy certification.
Gather the contract, information flow and existing security records a CMMC or NIST SP 800-171 specialist needs to propose and scope work.
FCI/CUI safeguarding and CMMC preparation. This package does not calculate a score, award status, perform an assessment or replace the required assessor.
Prepare business, item, technology, transaction and access facts for an export control specialist to determine jurisdiction, classification and required authorizations.
EAR and ITAR preparation with cyber and data handling questions. Sanctions, customs, nuclear exports, classified information and other regimes may require additional specialists.
Help counsel and a forensic consultant identify relevant people, devices, accounts, repositories and short lived records before collection.
Employment, confidential information and departure disputes. This package does not assume theft, recoverability, employer ownership of personal accounts or authority to access another organization.
Help counsel and a technical consultant locate the records of negotiation, agreement, performance, payment and change across business systems.
Contract and commercial disputes, including digital agreements and performance records. The pack gathers the records that legal and expert review starts from.
Help a legal and technical team identify relevant clinical, administrative and audit records for a medical matter and prepare a lawful, precise specialist handoff.
Medical treatment, documentation, privacy and related disputes. It is not a medical opinion, determination of altered records, an EMR vendor extraction manual or authority to access patient data.
This first release develops NYDFS Part 500, New York private information, defense contractor cybersecurity, EAR and ITAR and the three agreed case types. Other federal, state and sector programs have routing prompts only. It does not complete the existing fifty state utility expansion or close the earlier 18 New Jersey work packages, and it says so wherever a reader might otherwise assume it does.
The current CMMC implementation documents require contract specific reconciliation. New York hospital operative text, some full current federal text, actual client applicability, vendor configuration, collection authority and native and accessibility acceptance retain explicit source or client gates, and each gate is named in the package that depends on it.
Extract a downloaded ZIP before opening the HTML manuals. Use a current browser for searchable reading and the PDF for printing. CSV files are editable text tables, not formatted Excel workbooks: import them as UTF 8, keep identifiers as text, wrap and widen the columns, and save a client working copy in the approved location. The PDF is a reference document, not a fillable form. No passwords, patient data or controlled technical material belong in public forms or ordinary email, and the record index is designed so that none is needed there.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .