Collect the minimum data, control access, define retention and avoid exposing personal or confidential information. Apply this specifically to official issuer information, ethical preparation, practical competence and current renewal requirements. Record the owner, evidence, decision and review date so another qualified person can verify the result.