Meridian Field Services: instructional example, not project evidence
Scoping is a decision, not a lookup: a lawyer-adjacent judgment with a named determiner. Over- and under-inclusion both create exposure, so the ruled-out list is part of the decision.
Determined by: outside counsel with N. Duval, July 8; sponsor informed (applicability memo[1]).
| Regime | Class | Why it applies (this footprint) |
|---|---|---|
| Federal private-sector privacy law | MANDATORY | Personal data of employees in a federally regulated transport-adjacent fleet; counsel's memo attached |
| Provincial employment standards (monitoring notice) | MANDATORY | Staff monitoring at the Ontario workplace |
| Collective agreement: monitoring clauses | MANDATORY | Binding by contract force at the represented hub |
| Enterprise customer contract: security schedule | elected | Clause 14 retention, clause 18 audit rights; contract-driven |
| SOC 2-shaped shared control set | elected | One control set serves the privacy law, the contract schedule, and future procurement at once (the middle-layer rationale) |
Excluded, with rationale: payment-card standards (no cardholder data anywhere in scope, per entities[2]); health-privacy regimes (the classification register's special-category column says none, per PII register[3]). Re-scoping triggers: a new jurisdiction hub, a new data class entering the register, a customer segment with its own regime.
One shared control set: many obligations cite one control. Mechanisms are citations; a control that re-described SR-004 would drift the day SR-004 changed.
| Control | Cited by (clauses) | Mechanism (by id) | Evidence · cadence | Mode | Owner | Status |
|---|---|---|---|---|---|---|
| CTL-01 access control |
Privacy-law safeguards · schedule 18.2: one control, two obligations | permission model[4] · SR-004[5] | Quarterly access-review export | continuous: role-change audit events (audit events[4]) | E. Sandoval | COMPLIANT |
| CTL-02 retention & disposal |
Privacy-law limitation · clause 14 | retention rules[3] (cited, never restated) | Disposal-job log · monthly | periodic | N. Duval | COMPLIANT |
| CTL-03 monitoring notice |
Employment standards · collective agreement | The dispatcher-facing notice (consent model[3]) | Published notice + acknowledgments | periodic | N. Duval | PARTIAL |
| CTL-04 encryption |
Privacy safeguards · schedule 18.4 | SR-024, SR-025[5] | Platform configuration export | continuous: the drift check (environments[6]) | E. Sandoval | COMPLIANT |
| CTL-05 audit trail |
Schedule 18.6 · privacy-law accountability | SR-030, SR-031[5] · audit events[4] | Append-only audit stream · 2-y retention per retention rules[3] | continuous | E. Sandoval | COMPLIANT |
| Gap | Remediation | Owner | Target |
|---|---|---|---|
| CTL-03 partial | Union co-signature review of the notice (RSK-07[7]) | N. Duval | Aug 8, 2026 |
Audit-ready means the evidence exists before the request list lands, into a folder that is already full.
| Fact | Value |
|---|---|
| Basis | Enterprise contract schedule 18: annual customer audit, Type-II-shaped |
| Observation window | Six months ending Sep 30 |
| Fieldwork | Two weeks, October |
| Access | Named customer auditor: audit stream (read-only), access-review exports, three control owners for walkthroughs; production data access denied by design; evidence exports substitute (agreed with the customer July 10) |
| Findings route | Into the §2 gap table and, where material, the risk register by id (governance[7]); no new tracker for audit season |
| Question | Owner | Answer by | Blocks |
|---|---|---|---|
| Does the SOC 2-shaped elected control set formalize into an actual Type II engagement for enterprise sales next fiscal year? (Commercial decision with audit-cost implications.) | The sponsor with N. Duval | Nov 1, 2026 | Nothing in the current matrix |