Data release checklist: authority, payload, approval, and evidence

Authority is current

Confirm the executed agreement and all amendments, effective and expiration dates, recipient, project, related approvals, and institutional authority. Identify which version controls this release.

Purpose and recipient match

Compare the proposed purpose, recipient, downstream users, environment, transfer method, publication, and redisclosure intent with confirmed terms. Resolve ambiguity before payload review proceeds.

The exact data has been inspected

Attach and hash the schema, payload, authorized-user list, or query manifest. Compare fields, required values, population, rows, dates, and output scope with the allowed data. Correct the artifact and create a new run when it changes.

Time and lifecycle conditions are enforceable

Check agreement expiry, release date, access end date, maximum retention, renewal requirements, destruction evidence, and user authorization for the intended period.

Every required authority has decided

Complete attestations and required manager, privacy, security, legal, data-owner, or committee tiers. Verify quorum where applicable. Document exceptions with owner, remediation, due date, and authorized decision.

Enforcement and evidence are ready

Generate or verify the desired policy, compare connector state, deliver authenticated webhooks, and freeze the decision record. The final pack should contain source authority, artifact hashes, findings, approvals, exceptions, policy state, and decision version.

Confirm requirements against current source material.

Requirements and vendor capabilities change. Confirm the current source and your approved QC plan before changing a production process.

• NIST Privacy Framework
• NIST SP 800-53 Rev. 5