Appendix

# Appendix

**Appendix A: Templates and Checklists**

**Sample IG Policy Template (Data Classification)**
**Purpose**: Ensure all information is classified according to sensitivity and handled appropriately.
**Scope**: All employees, contractors, and systems.
**Definitions**: Public, Internal, Confidential, Restricted.
**Responsibilities**: Data owners classify; employees follow handling rules.
**Rules**: Restricted data requires encryption and restricted sharing.
**Exceptions**: Approved by CIGO.
**Enforcement**: Audits and disciplinary action.
**Revision Date**: Annual.

**Legal Hold Checklist**
- Identify custodians and data sources
- Issue hold notice
- Suspend disposition
- Monitor compliance
- Document hold scope and duration
- Release hold when no longer needed

**5x5 Risk Matrix (Blank)**
Likelihood \ Impact | 1 | 2 | 3 | 4 | 5
---|---|---|---|---|---
5 | 5 | 10 | 15 | 20 | 25
4 | 4 | 8 | 12 | 16 | 20
3 | 3 | 6 | 9 | 12 | 15
2 | 2 | 4 | 6 | 8 | 10
1 | 1 | 2 | 3 | 4 | 5

**IG Maturity Assessment Worksheet (ARMA-based)**
Principle | Current Level (1-5) | Target Level | Gap Actions | Owner | Due Date
---|---|---|---|---|---
Accountability | | | | |
Transparency | | | | |
(Repeat for all 7 principles)

**Appendix B: Tools and Resources**
- Microsoft Purview (classification, retention, e-discovery)
- Relativity (e-discovery)
- OneTrust (privacy management)
- Collibra (data catalog)
- OpenText (intelligent capture)
- NIST AI RMF Playbook
- ARMA IG Maturity Model 2025