Trust begins with a question you can examine.
An information-governance reviewer needs more than an assurance adjective. They need to know what material a workflow handles, who can use it, what happens when permission changes and which evidence supports the answers. A pharmacy owner needs the same clarity in a form that fits a smaller team. PHARMORIS development treats those questions as part of defining a useful evaluation, rather than something to postpone until after commercial enthusiasm.
The current controlled, non-production scope excludes patient-identifiable data, patient-facing functions and electronic patient record write-back. No completed independent security certification or suitability for a buyer's live environment is claimed here. Evidence for a particular assessment would need to identify the version, environment and scope it actually covers.
Begin with the permitted information
A proposed evaluation should list the information it needs and explain why each category is necessary. A process description or synthetic example may answer an initial question without operational records. Aggregate information can still carry commercial restrictions, and material described as anonymised needs an appropriate assessment of that claim. The first conversation should establish the minimum useful scope, not request a broad export that someone later has to justify.
Follow permissions beyond the source
Access to a publication, dataset or internal report does not automatically settle the right to reuse or redistribute it. The proposed data inventory would identify the source, permitted purpose, recipient, retention condition and restrictions on onward use. It would also distinguish original material from derived summaries. For a pharmacy group or health system, that inventory should make it possible to ask whether a cross-organisational review requires permissions beyond those held by an individual participant.
Examine ordinary changes in access
A person changes role, leaves an organisation or takes responsibility for a different review. Those ordinary events are useful security questions. An assessment should establish what access should change, who authorises it and what the examined version actually does. Relevant failure cases include an unauthorised request, an inappropriate organisational context and a permitted user attempting an action beyond their role. Public reading describes the questions; detailed evidence would be exchanged through an appropriately controlled review.
Make an assurance request answerable
The proposed artefact is a security evidence request matrix. Each row would connect a buyer question to its scope, evidence required, reviewer, known gap and decision. A policy statement, a test result and an independent assessment answer different questions, so they should remain distinguishable. A finding should not become current merely because it appears in a neatly presented pack. The matrix would record what was examined and what changes could make the evidence need refreshing.
Ask what happens when work is interrupted
A security discussion should include loss of access, an unavailable service and the need to recover an agreed state. The proposed evaluation would define which recovery question is relevant, what material can be used and what evidence would demonstrate the behaviour. A backup policy alone would not establish a tested restoration result. The buyer should also understand how an incident would be reported, who would coordinate the response and which activities should stop while the position is uncertain.
Plan the end of the evaluation
Exit arrangements matter even for a small assessment. The parties should agree which records may be retained, what must be returned or deleted and what evidence can remain in the evaluation report. Supplier and buyer responsibilities, any use of additional service providers and the relevant contractual terms need to be established for the actual scope. No evaluation should quietly expand into handling a new data category or connecting to a live clinical system without a separate decision.
Start with your assurance question
Tell us the workflow you are considering, the information it would require and the decision your technical or information-governance team needs to take. Do not submit confidential datasets or credentials through an initial enquiry. A useful next step would be an agreed evidence request and a bounded review plan, with any commissioned assessment, access or onward disclosure arranged separately.
External references
The NCSC cloud security principles provide a reference for examining a service and its provider. The ICO's accountability and governance guidance informs assessment of responsibilities where personal data is involved. These sources do not verify PHARMORIS controls. The inventory and request matrix described here are proposed evaluation artefacts, with their scope to be agreed.
