Security and compliance paperwork in order: from what is true to evidence you can show

How to use this order

Work through the steps in order and stop when you have what you need. Each step names a job that produces something you can check, and says what stays with you. This is an authored order, not a standard, and no step makes you certified.

Steps one and two: write down what is true, then keep answers from it

Start with policies that say only what you really do, each line confirmed by an owner. Then build a library of questions and answers, each with a source, an owner and a review date. A founder reported a 250-row customer questionnaire taking an entire weekend; a library of sourced answers is meant to cut that.

• Step 1: policies drafted from what you really do.
• Step 2: an answer library, then kept current as policies change.

Step three: answer the questionnaire or the scheme

Draft the customer's questionnaire from the library and leave unsupported rows blank for a named person. If a UK customer asks for Cyber Essentials, mark each of the five controls met, gap or unknown against evidence before you pay an assessor. The assessor marks the answers, and no one can promise you will pass.

• Step 3a: a questionnaire first draft, signed by your reviewer.
• Step 3b: a Cyber Essentials gap list and drafted answers for your director.

Step four: look at who has access and what your tools are telling you

Review the outside apps that can reach your tenant, the sign-in and admin activity, and who still has an account. Microsoft says native access reviews need an Entra ID Governance subscription, which Business Premium alone does not include, so a recorded review is often done from exports. Check what your own domains show to the internet only with a signed authorisation.

• Connected-app review, once and then each quarter.
• A monthly sign-in review and a quarterly access review record.
• A weekly sort of exported alerts, and a monthly sort of secret-scanning and code-scanning alerts. Dependabot alerts are sorted by the engineering alert jobs.
• A phishing-report triage batch.
• An exposure check of your own domains, with written authorisation.

Step five: keep evidence an auditor can test

For a SOC 2 or ISO 27001 control area, collect dated exports from your own systems, hash them and index them against the control text. Never write evidence to fill a gap. Compare policies with system exports each month so a statement that no longer matches is found by you first.

• An evidence pack for one control area, then refreshed each quarter.
• A monthly policy-drift check.

Step six: contracts, requests and registers

Put the renewal and notice dates of your contracts in one sheet with the page and quote for each, and keep them true; put the other key terms, such as liability and termination, in a second sheet. Write and test a process for subject access requests before the first one arrives. Keep a register of the suppliers and AI tools that touch personal data, with the legal columns left to your owner.

• Contract renewal and notice dates, key terms other than dates, and clauses checked against your written positions.
• A subject access runbook, search tool and redaction proposals.
• A supplier register and an AI tools register, each kept current.

Which paid job fits

Every job above is bought on its own, and each leaves the decision with you or your adviser. If you want one monthly arrangement, the security assurance lane covers answers, app reviews and sign-in review, and the compliance evidence lane covers evidence, access reviews and policy checks. Both are quote-first.