Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Use these packages to find, describe and organize information before engaging an auditor, cybersecurity consultant, attorney or export-control specialist. Begin with records you already have. An unanswered question is a request for help, not evidence of a violation.
This edition supplies gathering guidance, candidate data sources and question banks. It does not conduct an audit, determine legal applicability, certify security, classify an export, authorize collection or testing, or establish that a particular system or record exists. No new personal review or regulator endorsement is represented.
Legal entity, trade names, parent/affiliate chart and relevant client or case reference.
Purpose and recipient
Which audit, assessment, consultation, litigation question or export review is contemplated? Who requested it?
Period and locations
Start and end dates, time zone, state/country locations, business changes and exclusions.
People
Business sponsor, legal lead, coordinator, internal IT, provider contacts and person authorized to release records.
Systems and data
Actual tenants, accounts, devices, applications, paper stores, vendors and relevant data types.
Immediate concerns
Known active incident, imminent deletion, expiring logs, court order, transaction hold or contractual deadline. Escalate to the responsible professional; do not wait to finish the checklist.
Record the legal entity, business unit or case, intended recipient, purpose, relevant period, sites, systems and client contact. Ask the recipient which criteria, versions and deliverable format they expect. Keep an audit-preparation request separate from an incident response or litigation deadline.
2 Identify people and places
Ask the business owner what work occurred and ask IT where the resulting information lives. Include providers, acquired businesses, former accounts, paper files and legacy systems. Start with the data-source atlas; create one inventory row per actual tenant, repository or device, not one row per vendor name.
3 Check authority and preserve when necessary
Before changing accounts, retention or content, ask counsel and the authorized system owner what must be preserved and who can act. Escalate short-lived logs and pending deletion promptly. A hold request must be checked for actual scope and successful application. Do not assume that buying a license or creating a case preserved earlier data.
4 Gather existing records safely
Request existing exports and documentation through approved channels. Obtain a scoped collection plan if forensic acquisition, production testing, restoration or third-party access is needed. Use IDs and redacted examples until the receiving specialist confirms a secure route. Keep passwords, recovery secrets, private keys, patient records and controlled technical data out of ordinary email and public forms.
5 Describe what was supplied
Assign a request ID and record identifier. Record the source system, account or tenant, owner, period, retrieval time with time zone, method, filters, permissions, file format and known omissions. Where appropriate, have the collector create and verify a cryptographic hash. A matching hash establishes byte consistency between compared copies; it does not prove the content was truthful or complete.
6 Show gaps and limits
Use the statuses Not started, Requested, Received awaiting specialist review, Partially received, Not available after inquiry, and Proposed not applicable awaiting confirmation. Explain a missing period, excluded field, failed export or uncertainty. Never convert unknown to No or mark a request complete because one related document arrived.
7 Prepare a controlled handoff
Reconcile the request checklist to the file inventory. Separate ordinary records from restricted evidence and potentially privileged material. Agree access, permitted recipients, transmission encryption and retention. Obtain a receipt and list follow-up questions. The recipient decides whether the information supports the proposed engagement.
8 Maintain the package
Save the edition and source-review date with the handoff. Recheck the requirements and vendor documentation before the next engagement and whenever facts change. Version new submissions; retain the earlier index and explain changes. Do not release preservation or destroy records without the applicable owner and counsel decision.
Who helps with the gathering
Business contact
Explains the business, relevant events, services and people. Can identify records without answering technical control questions.
Project coordinator
Tracks requests, owners, dates, follow-up and handoff. Tracks receipt separately from specialist acceptance.
IT and provider contacts
Describe actual systems, permissions, retention, logging and export limitations. Arrange authorized technical work.
Counsel and privacy lead
Determine case scope, preservation, legal authority, privilege, protected information and applicable duties.
Receiving specialist
Agrees criteria and scope, specifies additional evidence and evaluates it. Export classifications and audit conclusions remain with qualified decision makers.
Suggested handoff folders
00 Scope and contacts
Engagement purpose, entity/matter facts, period, owner roster and exclusions.
01 Requests and responses
Completed request list, IT questionnaire, records of follow-up and unresolved questions.
02 Record index
Pointers to approved evidence locations; source, date, method, limits and receipt. Avoid placing sensitive data directly in this index.
03 Source records
Existing policies, diagrams, contracts and exports; keep restricted material in its approved repository with access controls.
04 Specialist decisions
Applicability, legal/process decisions, export classification or technical collection plan when actually supplied.
05 Handoff and updates
Transmittal, recipient receipt, known gaps, version history and supplemental requests.
Use the record index
Use one row per actual file or logically defined record set. Identify the associated request, original source, date range, collector/method, approved location and limits. Five blank template rows are supplied for extension. No invented case facts or evidence are prefilled.
The first four packages develop the approved initial regulatory priorities. The routing entries below identify additional work; they are not complete audit packages for every law, state, sector or agency.
NYDFS Part 500
Starting facts
Entity operating or required to operate under a relevant DFS authorization.
Records to locate
Legal entity/licensing, examination request, exemption/Class A support, period and existing program records.
Coverage of this edition
Use package 01. Legal scope and the final examination criteria require specialist confirmation.
Routing only. FISMA/FedRAMP or other agency-specific audits are not fully developed in this edition; do not treat a private business as automatically subject.
Specific entity, licenses, sites, residents, sector, government role, permits/orders and contracts.
Records to locate
An applicability register with source/version, actual facts, responsible reviewer and open questions.
Coverage of this edition
Not a fifty-state audit package. Refer utility/OT matters to the existing library and current unresolved registers; retain local and controlled-document gates.
A person who may possess or manage relevant information. The system owner may be a different person.
Tenant
An organization-specific cloud environment. One company can have several tenants and acquired or dormant domains.
Native file
A file in its original working format. A PDF printout can omit formulas, comments, versions, metadata or embedded material.
Metadata
Information describing a record, such as dates, owner, IDs or revision information. Its meaning depends on the application and collection method.
Log
A record of selected system activity. Logging must have existed, covered the event and been retained. A missing log entry does not establish that an action did not happen.
Archive
A retained repository that may preserve selected content. Coverage depends on capture, indexing, policy and configuration.
Backup
A recovery copy. Its contents, restore capability and point in time need confirmation; it is not automatically searchable or a litigation hold.
Legal hold
A preservation measure directed by counsel or an authorized process. The instruction, technical implementation and confirmation are distinct.
CUI and FCI
Controlled Unclassified Information and Federal Contract Information. Ask the contracting/data owner for the actual category and contractual basis; a company label alone is insufficient.
ECCN and USML
An Export Control Classification Number under EAR and the United States Munitions List under ITAR. A specialist determines classification and jurisdiction from item and technology facts.
Receiving the package
Ask the recipient to acknowledge what arrived, name unreadable/missing files and confirm the next information request. Keep their substantive review decision separate from delivery receipt. Do not label a complete collection an audit pass, an approved export or permission for a penetration test.
Timing and urgent matters
Agree gathering dates with the recipient based on records, access and provider availability. These are project targets, not legal deadlines. Active incidents, imminent deletion, filing deadlines, litigation orders and pending transactions go to counsel or the responsible specialist immediately. Do not wait for the ordinary package process.
