Evidence register

Full restore of the production payments database to an isolated environment; RTO/RPO, integrity, and end-to-end transaction validation.

Quarterly Risk Committee review of ICT risk posture, including approval of the ICT risk register and remediation tracking.

Current ICT risk register with inherent/residual scoring, owners, and treatment plans across all in-scope systems.

CIS-aligned hardening baseline attestation for production servers. Superseded cadence — due for 2026 refresh.

Register of critical ICT third parties with criticality tiers, exit plans, and last assessment dates.

Documented exit and substitutability plan for the primary cloud provider, including data portability and run-book.

Attestation that all data stores holding personal data are encrypted at rest with managed keys.

Important Business Services register with impact tolerances, approved by the board.

Severe-but-plausible scenario test of a payments outage against impact tolerances. Older than 12 months.

Data Protection Impact Assessment register covering high-risk processing activities.

Incident handling runbook covering detection, triage, response, and post-incident review with notification routing.

Formal annual review and sign-off of the ICT risk management framework.