Sooner or later someone asks which security frameworks your organization follows. Without a written answer, the reply depends on who picks up the question, and it changes from one questionnaire to the next. A short applicability record fixes that. It is one document that lists what your organization has decided applies to it, who made each decision, what advice the decision rested on, and when it was last reviewed.
One thing to be clear about before you start. Nothing here tells you whether any document satisfies anything, and nothing here identifies what you are obliged to produce. Which frameworks, standards and obligations apply to an organization varies by organization, by industry and by jurisdiction, and working out which ones apply to you belongs with a qualified professional who knows your situation. This article covers mechanics only: how the decision is written down, kept current and found again. It does not describe what any framework, standard or obligation contains.
Why a written record helps
The record gives everyone the same answer. A new staff member, a manager filling in a customer questionnaire and an outside advisor can all open the same page. It also shows that each decision was made deliberately, by a named person, on stated advice, rather than assumed.
What the record holds
Keep one row per framework, standard or obligation that has been considered, including the ones your organization decided do not apply.
| Field | What to write |
|---|---|
| Name | The name exactly as your advisor wrote it |
| Status | Applies, does not apply, or under review |
| Scope | Which parts of the organization the decision covers |
| Decided by | The person accountable for the decision |
| Advice relied on | Who advised, and the date of that advice |
| Next review | The date the decision will be looked at again |
| Notes | Anything a later reader would need to understand the decision |
How to build it
- Collect what has already been said. Gather past questionnaire answers, contract clauses and earlier emails that mention frameworks or obligations, so you can see what the organization has been telling people.
- Take the list to a qualified professional. Ask them which items apply to your organization and why, and ask for their view in writing.
- Record each decision. Fill in one row per item, using the advisor’s wording, and date the entry.
- Store it with your policy library. Keep the record next to the documents it relates to, with a version history, so the current copy is easy to find.
- Point people to it. When a questionnaire asks the question, answer from the record and note which version you used.
Keeping it current
Review the record on a cadence your organization chooses and writes down. Trigger an off-cycle review when something changes: the organization enters a new market, signs a contract with new terms, or an advisor revises their view. Keep superseded versions rather than overwriting them, so you can show what the organization understood at any earlier date.
What the record is not
It is not a credential, and it does not state that your organization meets anything. It records decisions and where they came from. Whether any document satisfies a requirement is a judgment for the party asking and for a qualified professional advising you.
When you are ready to gather the documents that sit alongside this one, work through the Trust Center Document Checklist page on this site and fill the gaps one document at a time.