Start with the tool list and a one-hour risk briefing. National authorities can now ask what you did, and right now the answer is nothing on paper.