Agree on information needs
Identify the records relevant to the assessment and explain how they relate to the scope. Never provide passwords, private keys, recovery phrases or unrestricted account access.
Maintain one coherent case record
Use a clear file index, event chronology and version history to reduce duplication and confusion. Track open questions and additional information needed for the next stage.
Control document sharing
Agree who may receive case material and for what purpose. Retention, storage and deletion arrangements must be confirmed as part of the actual service agreement.