Altiri 1. Describe the practice
State what the organization does, which systems or activities it covers, and who is responsible. Distinguish the intended process from what has been verified in operation.
2. Identify supporting records
Link to the relevant policy, procedure, and dated evidence. Record where the original artifact lives and how an authorized reviewer can access it. A link to evidence should not widen access to the evidence itself.
3. Record coverage and limitations
Explain the period, systems, or population represented by the evidence. Note missing records, exceptions, and questions that remain unresolved.
4. Assign review ownership
Name the person responsible for reviewing the record and define when it needs attention. An updated document date is not proof that the underlying safeguard was operating.
5. Preserve change history
Record meaningful changes, review decisions, and follow-up actions. Keep the documentation history separate from the operational logs used to demonstrate system activity.
A useful first exercise
Choose one access review, training cycle, or remediation item. Connect its description, owner, supporting records, and next review decision. Use that example to agree on a repeatable structure before expanding the scope.
Use Altiri’s action-plan guide and worksheet →