Acceptance checklists by service

Illustrative specimen or blank worksheet. Not a signed contract, legal opinion, client case or evidence that Dyasol has performed these operations. Complete and agree the relevant terms before use.

Using these checklists
Before work, select the service and agree the relevant criteria. At handover record criterion, pass/partial/fail/not applicable, evidence reference, reviewer, date, defect or new-scope decision and follow-up. Inspect usability, not just file presence. Public examples do not amend the quotation or the published 10-working-day review and one-round correction terms. A later customer question may reveal a defect in the original work; it is not automatically new chargeable scope. Treatment and time limits belong in the contract.

Email, domain and impersonation audit
Named domains/senders/hosts match scope; sample evidence is dated and reproducible; observed causes are distinguished from hypotheses; prioritised actions identify the owner; legitimate senders and limitations are recorded; client IT can act from the report. Remediation and delisting are not inferred as completed.

DORA / NIS2 readiness and evidence pack
Entity and chosen regulation match mandate; requirements map to reviewed evidence and sources; missing vs unverified controls are distinguished; contract/policy coverage reconciles to agreed inventory; roadmap has owners and priorities; management can trace one finding back to evidence. DORA track includes agreed register and authority scope; no certificate is implied.

Written applicability note
Named entity, activities, size/group facts and jurisdiction are recorded; direct duties separated from customer requests; sources and date recorded; conclusion follows stated facts; missing facts have owner and next step; no unsupported exemption or legal assurance.

DORA register work
Format/version and initial errors retained; scope identifies diagnostic vs correction work; each change traces to confirmed source; relational and other agreed checks have records; missing identifiers remain unresolved instead of invented; output opens in agreed tool; local validation, transmission and acceptance are separate.

Customer questionnaire response
Original questions/IDs/version preserved; each answer has factual owner, scope and evidence reference; planned work is not described as operating; commitments reviewed by commercial/legal owner; mandatory certification conditions identified early; approved final answers and attachments preserved; recipient can use the agreed format.

AI use and governance review
Inventory names tool and use case, source and unknown coverage; risks and approval owners explicit; data/output rules can be applied to a real task; legal classifications supported or left unresolved; survey/interview coverage and exclusions recorded; technical detection is not implied.

Technical implementation
Permitted systems/actions and change window recorded; baseline retained; rollback arranged where relevant; commissioned changes logged; agreed acceptance scenario repeated; remaining risk and dependencies documented; operating team can maintain the result without unsafe credential sharing.

CaaS / vCISO monthly support
Report reconciles agreed capacity with time used; completed work has evidence; deferred work and decisions visible; conflicts and availability respected; next period recommendation follows workload, including reduce/pause/hire proposals where appropriate. A report is not proof every control operates.

Human-factors workshop / analysis / refresh
Agreed participants/duration/scenarios or interview coverage recorded; technical recommendations reviewed; usable decision protocol and actions delivered; themes do not identify individuals; unresolved questions have owner; refresh records changes from prior version. Participation alone is not measured behavioural improvement.

Workplace wellbeing session
Agreed organisational purpose and participation recorded; outputs focus on work practices not clinical assessments; actions have owners and review route; confidential disclosures excluded from employer-facing report; no unmeasured burnout or turnover outcome claimed.

Email and domain monitoring
Agreed domains, signals, sources and frequency listed; missing telemetry distinguished from healthy state; alert delivery tested by agreed safe method; report links observations to dates and follow-up; response and remediation boundaries explicit; no universal inbox-placement promise.

Acceptance record
Engagement/version [ ]; criterion [ ]; result [ ]; evidence [ ]; reviewer/date [ ]; issue [ ]; original-scope defect or new request [ ]; agreed treatment [ ]; owner/due [ ]; final decision and authority [ ]. Do not tick “pass” where evidence is unavailable.