All attached decisions and directives must be valid, enforceable, and issued by an authorized party within the entity.

Samples vary based on the requirements of the standard and the requested evidence. They may include, but are not limited to, the following: -

• Samples of tools or models used for analyzing business impact (e.g., reports, tables, matrices).
• Samples from risk assessment studies (e.g., reports based on risk identification and analysis matrices).
• Samples of risk response strategies (e.g., analysis of risks associated with a service or field, along with a response plan and the responsible team).
• Samples from work teams (e.g., team rosters with hidden contact details; three samples may be attached to demonstrate the practice).

Other samples may include minutes, records or decisions, as specified in the standard’s requirements.
 

Attached reports must be issued by the relevant department and include all the information requested in the report submission guidelines.