The organization should define and maintain a list of which reports need to be provided. The list of reports should detail at a minimum the following:

  1. Name of the report.
  2. Creator of the report.
  3. Reviewer/approved where applicable.
  4. Source of data for report (e.g. name of person or system(s) used).
  5. Receiver(s).
  6. Format required (maybe referenced to a template report).
  7. Frequency of reporting.
  8. Details of what should be reported.
    a) Data points.
    b) Time period of measurement.
    c) Calculation formulas.


Reports should be archived as per the agreed period described in the SLA and/or retention policy of the organization.