Register the evidence in operational form.
Write the specific system decision: data location, remote access, provider, content surface, transaction, security control, filing question, or release condition.
Record authority, title, URL, language, publication or update information, date reviewed, and the exact material used. Keep vendor documentation separate.
Name the real organisation, parties, users, service, data, technology, destination, sector, provider, and date. Route legal or professional interpretation to a qualified reviewer.
Specify the architecture, field, notice, permission, vendor, test, documentation, exclusion, or stop condition that changes because of the decision.
Set a recheck point before scope, before release, and when the provider, data, audience, law, technology, or end use changes.