Checklist: documenting technical and organisational measures (TOMs)
For: Data protection leads and IT management
Updated: 2026-11
TOMs are documented credibly when they start from the actual estate: record systems and data, determine protection needs, record measures for access, authorisation, encryption, availability and logging per system, include processors, name owners and review effectiveness periodically.
The Swiss FADP requires data security appropriate to the risk, the GDPR appropriate technical and organisational measures. In practice many TOM documents consist of templates with little connection to actual operations.
This checklist leads to documentation that is accurate. The concept is explained in the glossary entry on TOMs.
The checklist
- 01
Record systems and data
List all systems containing personal data, including cloud services, and assign data categories.
Done when: The list is reconciled with the record of processing and contains no system without an owner.
- 02
Determine protection needs
Assess protection needs for confidentiality, integrity and availability per system.
Done when: Each system has a reasoned rating; particularly sensitive data is flagged.
- 03
Record access and authorisation
Describe sign-in, multi-factor authentication, roles and the permission process.
Done when: For each system it is documented who grants permissions and how they are reviewed periodically.
- 04
Describe encryption and transfer
Record encryption in transit and at rest and key management.
Done when: Gaps, such as unencrypted exports or backups, are named with a measure.
- 05
Prove availability and recovery
Describe and test backups, retention and recovery objectives.
Done when: A restore has demonstrably been carried out, not just configured, and the date is recorded.
- 06
Include processors
Incorporate processors’ measures through contracts and evidence.
Done when: For every processor there is a contract and evidence of its measures.
- 07
Assign ownership and review
Name owners and set a review cadence.
Done when: The documentation shows the date of the last review and the next one.
Common mistakes
- —Adopting a template that describes measures that do not exist in operations.
- —Forgetting cloud services and private devices actually used for work.
- —Documenting backups whose restore was never tested.
- —Writing TOMs once and not updating them when systems change.
What this checklist does not cover
- —The checklist does not replace an information security audit or a penetration test.
- —Whether measures are appropriate in a given case depends on the risk and may require professional or legal assessment.
- —Sector-specific requirements, for example from FINMA or in healthcare, go further and must be reviewed separately.
Parent service: Data Protection Consulting
Matching offers
revFADP implementation for SMEs: from status quo to evidence
A bounded package that takes a Swiss SME from uncertainty to a documented state: capture data flows and providers, determine obligations, review contracts and international transfers, provide privacy-policy groundwork and set clear procedures for data breaches and access requests.
GDPR & revDSG audit for SaaS
A data protection audit for SaaS checks whether data flows, processing agreements, deletion concept, and technical measures are GDPR- and revDSG-compliant. The output is a concrete finding with prioritised fixes — from people who run SaaS themselves.
Automating data subject access requests
We build a process that lets your company answer access, rectification and erasure requests under the Swiss FADP and the GDPR on time and traceably: intake channel, identity check, a map of where personal data lives, automated queries via interfaces, response templates and a log per request. Legal assessment of individual cases stays with you or your law firm.
FAQ
Is TOM documentation mandatory?
Both regimes require appropriate data security and the ability to demonstrate it. Documentation is the practical way to do so.
How detailed must TOMs be?
Concrete enough for a qualified person to understand what is actually implemented per system.
Do TOMs belong in the processing agreement?
Yes. The agreement typically references the processor’s TOMs as an annex.
More checklists
Checklist: accepting software without nasty surprises
Software acceptance succeeds when acceptance criteria are fixed before testing: test cases derived from requirements, realistic test data, testing by future users, a clear classification of defects by severity, a signed protocol and an orderly handover to operations with documentation and access.
Checklist: ready to report a cyberattack within 24 hours
A company is ready to report when it has clarified its applicability under the ISA, regulated roles and 24/7 reachability, has a decision aid on the reporting duty, prepared the initial report, knows parallel reporting duties, obliged providers to cooperate and exercised the process.
Checklist: preparing for SRO membership
SRO membership is prepared in seven steps: clarify coverage and professional activity, choose a suitable SRO from the current FINMA list, define organisation and AML responsibility, align directives with the regulation, prepare a risk assessment, submit a complete application and set up operations with documentation from the first client.