Keep enquiry separate
Send only non-confidential scope information through a public enquiry route. Do not attach unpublished filings, CCC, tokens or shared Login.gov credentials.
Review the processing chain
Confirm permitted people, devices, storage locations, transfer tools and retention. An NDA by itself does not establish those controls.
Approve external tools
Do not use consumer conversion sites or AI tools on private material without client permission and suitable vendor terms. A public-file practice workflow is not automatically approved for live work.
Close out deliberately
Agree who retains the final package, when working copies are deleted, how backups expire and which contact receives incident reports. Actual implementation should be documented during onboarding.
Scope and primary reference
Educational production guidance only. Client disclosure approval, legal/accounting judgement, qualified tagging review and filing authority remain separate. Confirm the appropriate qualified review and current requirements for each live assignment.
Reference: Current official SEC guidance. Verify the current requirements for the agreed job.