Turn “we had security measures” into “I can prove it”

Most mid-sized Spanish companies have reasonable protection in place. Almost none has the file that documents it. That gap, which today looks administrative, on the day of the claim is the gap between an acquittal and a run of judgments against you.

The Demonstrable Diligence File is the dossier with which you will win the cases that come after an attack. It is not an audit of your systems, nor a generic compliance manual: it is the ordered, dated and signed construction of the evidence a Spanish court values.

Who it is for

• Companies holding the personal data of thousands of customers, patients or users on their own systems.
• Anyone who has suffered an incident in recent months and has still not closed the evidence file for that episode. This is the most urgent item on the list.
• Anyone who has watched a competitor in their sector receive an avalanche of claims and does not know what they would hand over if it were their turn tomorrow.
• Boards and chief executives that need a documented answer, not a reassuring one, to the question “are we covered?”.

It is not for you if you are looking for an infrastructure review. We do not assess systems here: we assess and build your ability to prove. If you do not know where to begin, begin with the Breach Management Test.

What it includes, exactly

1. Dated inventory of measures. What protection you have in place, since when, who approved it and what documentary support proves each point.
2. Written protocols. Who decides what and within what deadline when an incident occurs, with the chain of command in writing and signed, not assumed.
3. Register of access and of decisions. The trail that lets you reconstruct, without reconstructing anything, who accessed what and what was decided at each moment.
4. Documented training. Content, date, attendees and proof of attendance for every session given to your staff.
5. Register of corrections. When inaccurate data was detected, when it was rectified or erased and why, with a record of every step.
6. Master index of the file. A single document that says where each piece of evidence is, so that it can be handed over in days rather than months.

Which rule it addresses

Rule A — Demonstrable diligence, not infallibility. The courts assess diligence in the specific case, one case at a time. The Madrid Provincial Court of Appeal absolved the defendant on the basis of its conduct and of what it was able to prove, and found a measure as modest as a password-protected file with restricted access to be sufficient.

Rule D — Accountability. Complying is not enough: you have to be able to demonstrate it, and the burden of that demonstration falls on you. It is the reason this service exists.

Deliverables

• The complete file in ordered and dated documentary form, ready to hand to a lawyer or to a court.
• Master index with the location of each piece of evidence and the rule that justifies it.
• Written decision and response protocols, signed by the right people.
• Register templates to keep the file alive without depending on us.
• Gap report: what evidence does not exist today, what consequence that has and in what order to close it.

Indicative timescale

Between four and eight weeks depending on the number of systems and suppliers involved. If you have suffered a recent incident, the evidence relating to that episode is dealt with first and separately, in the first few days.

Before engaging anyone, it is worth understanding what is at stake: we explain it in what a court really looks at after a breach, and you can measure it in your own company with the Breach Management Test.