DSGVO
Documenting TOMs properly: a pragmatic guide
Technical and organisational measures, TOMs for short, link legal requirements to actual IT operations. The GDPR requires them in Art. 32, and the risk management measures under NIS-2 build on similar elements. Even so, in many companies TOMs exist only as a template downloaded from the internet.
Why templates are not enough
A generic list describes what could be done, not what has actually been implemented. Yet in an audit or after an incident, that is exactly what counts. Good TOM documentation describes the current state honestly and names open items.
A proven structure
- Confidentiality: physical access, system access and data access control
- Integrity: transfer and input control
- Availability and resilience: backup, redundancy, contingency planning
- Procedures for regular review and evaluation
Specific rather than general
Instead of "secure passwords are used", the documentation should state which policy applies, how multi-factor authentication is implemented and in which system it is enforced. Specific statements can be verified and improved.
Linking to the technology
Many measures can be evidenced directly from existing systems, for example from policies in Microsoft Intune, Conditional Access rules in Entra ID or backup reports. Linking the documentation to these sources keeps it up to date with little effort.
Review regularly
TOMs are not a static document. New systems, cloud services or organisational changes require updates. A fixed review cycle, for example annually and after major changes, ensures that paper and reality match.
This turns a mandatory exercise into a tool that makes risks visible and sets priorities.