> category_sec
Security, Privacy & Compliance
Threat models, secure SDLC checklists, and security review registers aligned with NIST CSF and OWASP ASVS.
Important Tech Document Template & Operational Notice
TinyCTO.tv Tech Document Template Notice: This template is a general educational and operational starting point. It is not legal, tax, accounting, investment, procurement, regulatory, security or certification advice. Requirements vary by jurisdiction, organization, contract and risk. Review and adapt it with qualified professionals before relying on it.
Agent Handoff and Context-Transfer Protocol
Inter-agent communication specification and context-transfer protocol governing typed payloads, conversational state transfer, intent preservation, role-swapping safeguards, idempotency tokens, and lossy-context degradation prevention.
Agent Identity, Credential and Permission Design
Zero Trust security architecture and privilege delegation design for autonomous AI agents, standardizing workload identities (SPIFFE/OIDC), short-lived ephemeral token minting, on-behalf-of (OBO) user authorization chains, OAuth scope attenuation, and audit-logged non-repudiation envelopes.
Agent Incident-Response Runbook
Operational incident response protocol standardizing severity classification (SEV1-SEV4), containment workflows, forensic memory triage, poisoned context sanitization, and stakeholder notifications during autonomous agent security and reliability failures.
Agent Tool and Capability Registry
Enterprise AI agent tool orchestration and execution governance registry cataloging deterministic API tools, Model Context Protocol (MCP) server endpoints, input JSON schema contracts, rate limits, write-action confirmation gates, and blast-radius risk classifications.
Agent Tool-Security, Approval and Transaction-Control Plan
Enterprise security governance and transaction-control framework establishing strict capability-based authorization, two-man rule Human-in-the-Loop (HITL) approval gates for irreversible actions, cryptographic tool request signing, and parameter injection sanitization.
AI Governance Operating Model and Control Catalogue
Enterprise artificial intelligence governance operating model and comprehensive control catalogue establishing AI ethics committee charters, multi-tier risk classification schemas (Unacceptable, High, Limited, Minimal), lifecycle approval gates, and continuous compliance registers under ISO/IEC 42001 and the EU AI Act.
AI Incident-Response Plan and Runbook
Operational incident response plan and crisis runbook governing AI-specific emergencies: massive hallucination outbreaks, prompt injection compromises, toxic output generation, training data poisoning, unauthorized agentic tool execution, and statutory regulatory breach notifications under EU AI Act Article 73.
AI Red-Team Plan and Findings Register
Adversarial AI safety assessment plan and vulnerability register evaluating foundation models and agentic RAG architectures against direct/indirect prompt injection, jailbreaking, training data exfiltration, system prompt extraction, model inversion, and tool abuse under OWASP LLM and MITRE ATLAS frameworks.
AI Risk Register
Dynamic AI risk catalog quantifying prompt injection, hallucination, data leakage, unbounded tool abuse, and cost overrun vectors.
AI System Inventory and Accountability Register
Enterprise-wide AI and machine learning system registry recording statutory risk tiers (Unacceptable, High, Limited, Minimal under the EU AI Act), model lineage, training data dependencies, deployment context, designated business/technical owners, and ongoing impact assessment statuses.
RAG Architecture Document & Production Specification
Production architecture specification for Retrieval-Augmented Generation (RAG) systems covering ingestion pipelines, chunking, hybrid retrieval, cross-encoder re-ranking, grounding policies, and the RAG Triad evaluation framework.
Agentic-RAG Workflow & Tool Contract
Production-grade specification for autonomous ReAct cognitive loops, strict JSON Schema tool calling contracts, execution sandboxing, human-in-the-loop intercepts, and RAG Triad evaluation.
API Architecture and Developer-Experience Standard
Enterprise API architectural standard and developer experience (DevEx) manual establishing design patterns across REST (OpenAPI 3.1), gRPC, and GraphQL, URI taxonomy, error response contracts (RFC 7807), rate-limiting headers, versioning and deprecation lifecycles, and automated linting governance.
API Contract Specification
Contract-first API specification governing REST and event schemas, idempotency keys, rate limits, and RFC 7807 error responses.
Software Architecture Document (SAD)
Production-grade technical architecture blueprint covering system context, container topology, data flow, trust boundaries, and operational quality attributes.
Architecture Decision Record (ADR) Pack
Production-grade architectural decision governance framework based on MADR 3.0 and ISO 42010 with state machine lifecycle, weighted options matrix, and trade-off registers.
Architecture Review and Governance Pack
Formal architecture governance and review board framework detailing ARB intake submission templates, multi-pillar evaluation scorecards, technical debt logging, waiver tracking, and architectural sign-off gates.
Audit Evidence Register and Assurance Plan
Comprehensive internal and external audit assurance framework detailing population sampling methodologies, evidence collection cadences, evidence custodian assignments, and formal audit defensibility logs.
Audit Finding and Remediation Tracker
Comprehensive internal, external, and regulatory audit finding governance tracker managing deficiency classifications, root cause analyses, management remediation action plans (CAP), aging schedules, closure evidence packages, and Board Audit Committee reporting dashboards.
Autonomous-Action Audit Ledger Specification
Tamper-evident, cryptographically verifiable audit ledger architecture standardizing chronological transaction recording, cryptographic chain-of-custody, SHA-256 Merkle tree verification, and WORM storage compliance for all high-stakes autonomous agent actions.
Backup, Restore and Recovery Validation Plan
Enterprise data resilience and backup governance plan establishing automated backup schedules, air-gapped immutable WORM storage, cryptographic key segregation, routine restore validation cadences, and granular RPO/RTO verification matrix across cloud and database tiers.
Board and Technology Governance Pack
Fiduciary board of directors governance dossier and audit committee briefing pack presenting enterprise cyber posture, technology strategy alignment, SEC Item 106 material incident readiness, digital transformation capital ROI, AI oversight principles, and systemic risk mitigation.
Cloud Architecture Document
Comprehensive cloud architecture blueprint detailing enterprise Landing Zone design, multi-account organizational structure, identity federation, transit gateway networking, infrastructure-as-code automation, and Well-Architected 6-pillar governance.
Cloud Security Blueprint and Guardrails
Comprehensive multi-account cloud security blueprint and automated guardrails specification defining preventative Service Control Policies (SCPs), detective security benchmarks (CIS Foundation), centralized SIEM audit aggregation, Zero Trust network perimeter isolation, and cloud workload protection (CWPP/CSPM).
Compliance Obligations and Evidence Register
Comprehensive regulatory compliance inventory and automated evidence repository tracking statutory laws, regulatory operating licenses, reporting deadlines, internal control mappings, responsible executive custodians, and auditable proof artifacts across SOX, SOC 2, ISO 27001, GDPR, and NIS 2 frameworks.
Compliance Readiness and Control-Crosswalk Workbook
Enterprise multi-framework cybersecurity compliance mapping workbook harmonizing common controls across SOC 2 Type II, ISO/IEC 27001:2022, NIST CSF 2.0, PCI-DSS 4.0, and GDPR/KVKK.
Content-Safety and Moderation Policy/Decision Matrix
Comprehensive input/output AI moderation and trust-and-safety framework establishing category harm taxonomies (hate, violence, self-harm, sexual, PII, prompt injection, jailbreaks), severity scoring thresholds, multi-tier enforcement actions (block, redact, warn, human review), and audit logging compliant with the EU AI Act.
Crisis Governance and Executive Response Protocol
Executive crisis governance protocol and emergency response framework establishing C-suite command team activation, attorney-client privilege protections, emergency board notification cadences, coordinated regulatory reporting, and pre-approved external media holding statements during catastrophic cyber, financial, or operational events.
Customer and Tenant Onboarding/Offboarding Plan
End-to-end multi-tenant lifecycle framework governing automated tenant provisioning, identity federation (SAML/SCIM), data isolation boundaries, billing activation, cryptographic decommission, data export escrow, and GDPR-compliant secure data erasure.
Cybersecurity Risk Register and Control-Treatment Plan
Comprehensive cyber risk management framework establishing quantitative likelihood/impact scoring, inherent vs residual risk calculation, threat scenario registers, and formal treatment actions.
Data Classification, Handling, Retention and Deletion Pack
Unified data governance security standard defining 4-tier sensitivity labeling (Public, Internal, Confidential, Restricted), cryptographic handling rules, retention schedules, and NIST SP 800-88 defensible sanitization.
Data Processing Agreement Requirements Worksheet
Statutory data protection agreement specification defining mandatory controller-to-processor covenants, cross-border transfer mechanisms (SCCs), sub-processor authorization protocols, breach notification timelines, and data deletion audits.
Data Requirements, Data Dictionary and CRUD Matrix
Comprehensive business data governance workbook detailing entity-attribute definitions, physical data types, validation constraints, default values, and Create/Read/Update/Delete (CRUD) role entitlement matrices.
Dataset Requirements and Datasheet Pack
Comprehensive dataset requirements specification and standardized Datasheet for Datasets documentation framework detailing provenance, sampling methodology, composition, demographic distributions, licensing, and ethical usage boundaries.
Disaster Recovery and Technology Continuity Plan
Comprehensive enterprise disaster recovery (DR) and technology business continuity plan establishing Recovery Time Objectives (RTO), Recovery Point Objectives (RPO), multi-region replication architectures (Warm Standby / Pilot Light), automated failover runbooks, and annual unannounced DR drill protocols.
Enterprise Governance Charter
Authoritative executive governance charter establishing board technology committee oversight, delegated authority matrices (DOA), operating cadences, and enterprise risk management (ERM) policies.
Enterprise Security Architecture Document
Comprehensive Zero Trust cybersecurity architecture defining identity perimeter controls, data encryption lifecycle, threat boundaries, and micro-segmentation policies.
Explainability, Fairness and Bias Assessment
Comprehensive algorithmic fairness and model explainability framework establishing demographic parity metrics, disparate impact ratios, SHAP feature importance analysis, counterfactual explanations, and adverse action notice generation under the EU AI Act and NIST AI RMF.
Financial Controls and Reconciliation Matrix
Internal control framework and monthly reconciliation matrix codifying segregation of duties (SoD), automated billing-to-ledger reconciliations, multi-tiered purchase order authorization thresholds, automated payment gateway audit trails, and SOX 404 IT General Controls (ITGC).
Founder Employment and IP-Assignment Requirements Worksheet
Foundational startup intellectual property assignment and executive employment agreement worksheet ensuring all past, present, and future code, patents, domain names, and trade secrets are irrevocably transferred from individual founders to the corporate entity, alongside invention disclosure schedules and restrictive non-disclosure covenants.
Identity, Access and Privileged-Access Matrix
Enterprise identity and privileged access governance framework detailing RBAC/ABAC role entitlements, just-in-time (JIT) access grants, break-glass protocols, and quarterly recertification cadences.
Identity and Access Management (IAM) Standard
Enterprise IAM governance standard establishing role-based access control (RBAC), least-privilege principles, credential hygiene, and quarterly access recertifications.
Internal Controls and Evidence Matrix
Enterprise IT General Controls (ITGC) and internal controls over financial reporting (ICFR) testing matrix mapping control activities, test procedures, frequency, control owners, deficiency classifications, and contemporaneous evidence artifacts across change management, logical access, computer operations, and data integrity under SOX 404 and COSO.
Knowledge Freshness, Re-indexing and Deletion Plan
Production RAG data lifecycle and corpus governance plan standardizing automated re-indexing triggers, document obsolescence/TTL pruning, partial vs full re-embedding pipelines, GDPR/CCPA Article 17 "Right to be Forgotten" hard vector deletion protocols, and index drift telemetry.
Landing-Zone Design
Architectural specification for multi-account cloud landing zones, detailing hub-and-spoke networking, centralized identity federation, automated SCP guardrails, and compliance baselines.
M&A Technology Due-Diligence Pack
Comprehensive pre-deal technical due diligence assessment evaluating target software architecture, cybersecurity posture, open-source licensing risks, technical debt, and post-close integration CapEx.
Master Services Agreement (MSA) Engineering Schedule
Technical schedule to an MSA defining intellectual property ownership, open-source compliance warranties, liability caps, and engineering SLA commitments.
ML Incident-Response Runbook
Emergency production incident response runbook for machine learning services detailing triage workflows, automated shadow fallbacks, heuristic kill-switches, upstream data contamination isolation, concept drift mitigation, and model rollback procedures.
Model Card and System Transparency Dossier
Authoritative machine learning documentation and transparency dossier following the Mitchell et al. standard and EU AI Act Article 13/14 requirements, detailing model intended use, out-of-scope applications, architectural parameters, training data provenance, quantitative evaluation benchmarks, ethical limitations, and environmental carbon footprint.
Multi-Agent Authority & Responsibility Matrix
Governance framework defining autonomous agent capabilities, maximum execution authorities, financial transaction thresholds, sandboxing boundaries, and human-in-the-loop escalation circuits.
NDA Requirements Worksheet
Enterprise non-disclosure agreement requirements standard defining confidentiality scope, mutual vs unilateral terms, residual knowledge exceptions, non-solicitation covenants, trade secret remedies, and mandatory return/destruction protocols.
Observability Architecture and Telemetry Strategy
Comprehensive enterprise observability architecture and telemetry standard defining unified distributed tracing (W3C Trace Context, OpenTelemetry), metric cardinality controls, structured JSON logging schemas, sampling rate strategies, and alerting noise reduction across microservices and serverless workloads.
Penetration-Test Scope and Remediation Tracker
Offensive security rules of engagement, target scoping sheets, vulnerability verification logs, CVSS scoring rubrics, re-testing protocols, and formal remediation sign-off attestations.
Policy Lifecycle and Exception Management Pack
Enterprise policy governance framework and exception management protocol defining standard drafting workflows, annual recertification cadences, executive approval hierarchies, time-bound policy waiver/exception registers, and compensating control mandates.
Privacy Impact and Data-Protection Assessment Worksheet
Statutory privacy risk appraisal framework guiding engineering and legal teams through systematic evaluation of personal data processing, necessity, proportionality, and mitigating technical controls.
Procurement Conflict-of-Interest Register
Governance compliance register and disclosure framework capturing personal affiliations, financial stakes, gifts/hospitality logs, reciprocal business ties, and formal recusal orders during sourcing decisions.
RAG Security, Access-Control and Privacy Plan
Enterprise defense-in-depth security architecture for RAG systems establishing document-level access control lists (ACLs) pre-filtering, cryptographic multi-tenant vector index partitioning, pre-embedding PII sanitization, indirect prompt injection defense, and vector deletion compliance.
Records Retention Requirements Matrix
Enterprise records management and defensible disposition workbook cataloging statutory retention schedules across accounting, tax, corporate, employment, medical, and security telemetry records, legal hold protocols, Write-Once-Read-Many (WORM) storage rules, and certified destruction workflows.
Regulatory Change Impact Assessment
Comprehensive regulatory horizon scanning, technical gap analysis, and capital compliance planning framework evaluating the impact of emerging statutory regulations (e.g. EU DORA, NIS 2, EU AI Act, SEC Cybersecurity Rules) across enterprise software architectures, vendor contracts, operational processes, and balance-sheet Capex/Opex allocations.
Risk Appetite and Tolerance Statement
Enterprise risk governance policy and operational boundary framework defining board-approved risk appetite statements, quantitative risk tolerances, Key Risk Indicators (KRIs), escalation thresholds, and risk acceptance protocols across cybersecurity, cloud operations, third-party resilience, and regulatory compliance.
Sandboxed Agent Execution and Resource-Policy Specification
MicroVM and containerized isolation architecture standardizing isolated dynamic code execution environments, ephemeral scratchpads, strict egress firewall policies, CPU/memory quotas, and zero-trust sidecar proxies for untrusted agent-generated code.
Threat Model & Security Review Pack
Production-grade zero-trust threat modeling specification covering STRIDE vectors, DFD trust boundaries, quantitative DREAD scoring, and OWASP ASVS verification.
Secrets, Keys and Certificate Lifecycle Plan
Enterprise cryptographic management standard governing secret rotation cadences, HSM-backed master keys, automated TLS certificate renewal (ACME), and emergency secret leak revocation protocols.
Secure SDLC and Security-Gate Plan
Engineering security baseline integrating threat modeling, pre-commit secret detection, automated SAST/DAST/SCA quality gates, container image signing, and deployment blocking thresholds.
Security Incident Response Plan
Comprehensive corporate cybersecurity incident response framework detailing triage severity tiers, containment runbooks, chain-of-custody digital forensics, 72-hour regulatory breach reporting, and postmortem learning.
Security Logging and Auditability Requirements
Enterprise security logging specification and auditability framework detailing mandatory security event schemas, immutable WORM log storage, SIEM ingestion pipelines, automated tampering alerts, PII log redaction, and compliance retention periods.
Security Requirements Specification
Engineering security baseline translating compliance mandates into actionable functional and non-functional security controls across authentication, authorization, cryptography, and input validation.
Software Supply-Chain and SBOM Assurance Pack
Software supply-chain security framework and Software Bill of Materials (SBOM) assurance pack detailing machine-readable component inventories (CycloneDX/SPDX), cryptographic artifact signing, dependency vulnerability scanning, open-source license compliance, and SLSA Level 3 provenance verification.
Succession Planning and Key-Person-Risk Register
Enterprise engineering continuity and organizational resilience framework standardizing "Bus Factor" exposure quantification, single-points-of-failure (SPOF) role registers, 9-Box potential assessments, emergency interim succession protocols, and 12-to-24 month successor talent pipelines.
Synthetic-Data and Privacy-Preserving ML Assessment
Engineering assessment and mathematical verification framework for synthetic data generation and Privacy-Preserving Machine Learning (PPML) establishing Epsilon-Differential Privacy budgets (ε, δ), membership inference attack resilience, statistical fidelity scoring, and regulatory GDPR/HIPAA anonymization qualification.
Technical Due Diligence Data Room Index
Comprehensive index taxonomy organizing technical due diligence evidence (architecture, IP, security, licenses, org charts) for Series A-C and M&A diligence.
Test Data Management and Privacy Plan
Enterprise test data governance and privacy engineering architecture standardizing synthetic data generation, automated PII masking/pseudonymization, subsetting pipelines, self-service test environment provisioning, and compliance verification.
Third-Party Risk Register
Comprehensive vendor risk management register tracking financial solvency, geopolitical exposure, fourth-party concentration, cybersecurity posture, and business continuity safeguards across all suppliers.
Third-Party Security & DPA Assessment
Structured vendor security vetting matrix and Data Processing Agreement (DPA) assessment rubric for technical compliance and third-party risk management.
Vendor Onboarding and Access-Readiness Checklist
Operational vendor onboarding and zero-trust access enablement checklist detailing legal document validation, banking/ACH anti-fraud verification, least-privilege PAM credentials, and Day-1 delivery sign-off.
Vulnerability, Patch and Remediation Plan
Comprehensive vulnerability lifecycle framework establishing risk-based CVSS/EPSS prioritization, binding remediation SLAs (Critical 24h, High 7d), emergency zero-day patching protocols, and exception governance.