Identify the information owner
Record who can approve the release, what the recipient needs and whether unrelated records can be removed.
Security
File sharing security and compliance guides
Use these UK guides to assess recipient checks, file protection and the evidence needed for a particular workflow.
Start with your situation
Choose the question you need to answer
Start with the information, recipient and release decision. Then use the relevant framework guide to identify the controls, owners and evidence to review.
01
Understand file protection
Explore the role of encryption within a wider sharing process.
First checkAlso review recipient authentication, permissions and how access is removed.
Explore this approach 02Review exchange evidence
Explore the activity information your team may need after a handover.
First checkDecide which events matter and how someone will investigate an unexpected action.
Explore this approach 03Assess a security programme
Explore file exchange within an information security management approach.
First checkConnect the workflow to your organisation’s risk assessment, ownership and review process.
Explore this approachExplore the full collection
Search the guides
01
Regulated business & government
DORA
Explore DORA guidance, the questions to ask and the evidence to review for your file exchanges.
Explore DORAGxP
Explore GxP guidance, the questions to ask and the evidence to review for your file exchanges.
Explore GxPNIST SP 800-171
Explore NIST SP 800-171 guidance, the questions to ask and the evidence to review for your file exchanges.
Explore NIST SP 800-171PCI DSS
Explore PCI DSS guidance, the questions to ask and the evidence to review for your file exchanges.
Explore PCI DSS02
Protect the exchange
Encrypted File Sharing
Understand encryption within the wider file-sharing process.
Explore Encrypted File SharingFile exchange with audit trails
Review the activity record behind an external exchange.
Explore File exchange with audit trailsPrivate file sharing
Limit access to the intended participants.
Explore Private file sharingSecure Data Storage
Distinguish storage safeguards from controls on external sharing.
Explore Secure Data StorageSecure evidence sharing
Organise sensitive evidence and its delivery to approved recipients.
Explore Secure evidence sharingSend Files Securely
Bring recipients, access conditions and delivery into one process.
Explore Send Files Securely03
Privacy & cloud
UK GDPR
Explore UK GDPR guidance, the questions to ask and the evidence to review for your file exchanges.
Explore UK GDPRISO 27017
Explore ISO 27017 guidance, the questions to ask and the evidence to review for your file exchanges.
Explore ISO 27017ISO 27018
Explore ISO 27018 guidance, the questions to ask and the evidence to review for your file exchanges.
Explore ISO 27018ISO 27001
Explore ISO 27001 guidance, the questions to ask and the evidence to review for your file exchanges.
Explore ISO 27001PIPEDA
Explore PIPEDA guidance, the questions to ask and the evidence to review for your file exchanges.
Explore PIPEDAUK Data Protection Act
Explore UK Data Protection Act guidance, the questions to ask and the evidence to review for your file exchanges.
Explore UK Data Protection ActMake a more informed decision
Use three layers for a more useful security review
Exercise the access settings
Use a sample file to check the invitation, permissions and expiry from the recipient’s side.
Ask for evidence with a defined scope
Match supplier documentation to the service, version and configuration you intend to use. Keep unresolved questions with the review owner.
Example: reviewing a supplier exchange
Start with a technical package and named receiving team. Review the access conditions and activity record, then map the remaining questions to your internal assessment. Keep product demonstrations and documentary evidence connected to that same scenario.
Make your next exchange clearer