Archived decisions

Governance documents
and policies

Ongoing assurance on adequacy and effectiveness of controls over key risks

Other sources of assurance (including third party)