Connections to set up

• Surveillance provider. Configure a connection if monitoring alerts will arrive from a specialist service. Map its alert identifier, detection time, subject reference and score to the correct assessment and organization. Agree who resolves duplicate or incomplete intake before enabling it.
• Evidence repository. Arrange access to external material referenced by control tests and retests. Confirm that a permitted reviewer can follow the reference and that files shared with the assessment have the intended visibility.
• Identity directory. Map authorized user identities to team members and organizational responsibility during setup. A display name or email resemblance does not establish the correct account binding.
• Subject authority records. Agree where identity and disclosure authority references lead. The Data Custodian confirms the permitted purpose and scope before information is accessed or shared through a connection.

Name the owner of each connection and agree which system controls the source identifier. Test with synthetic records and reconcile an imported alert to its intended assessment before widening intake. Keep connection credentials outside business evidence and restrict access to the people maintaining the connection.

An operation receipt describes the guarded action result. Where an external system must acknowledge an action, inspect its correlated result before calling the external work complete. A local status change alone cannot establish that acknowledgment. Repeated requests should resolve to the same intended effect; investigate an uncertain result before issuing a fresh action.

Rehearse implementation with the source-system owners.