Free resources
Compliance checklists
Every item mapped to its official requirement number, with the evidence an auditor will ask for. Versioned, dated and kept current. Preview each one here and get the full checklist as a branded, fillable PDF.
PDF · v1.0SOC 2 readiness checklist
Every SOC 2 Trust Services Criterion a service organization has to act on, mapped to its criterion ID, with the evidence an auditor will ask for.
66 items · SOC 2 2017 TSC (2022 points of focus) · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0ISO 27001:2022 readiness checklist
Every ISO/IEC 27001:2022 management system clause and Annex A control an organization has to act on, mapped to its clause or control number, with the evidence a certification auditor will ask for.
110 items · ISO/IEC 27001 2022 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0GDPR readiness checklist
Every GDPR obligation a controller or processor has to act on, mapped to its article, with the evidence a supervisory authority or auditor will ask for.
90 items · GDPR Regulation (EU) 2016/679 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0HIPAA readiness checklist
Every HIPAA Security, Privacy and Breach Notification Rule requirement a covered entity or business associate has to act on, mapped to its 45 CFR citation, with the evidence OCR or an assessor will ask for.
100 items · HIPAA Security, Privacy and Breach Notification Rules · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0ISO 42001:2023 readiness checklist
Every ISO/IEC 42001:2023 AI management system clause and Annex A control an organization has to act on, mapped to its clause or control number, with the evidence a certification auditor will ask for.
65 items · ISO/IEC 42001 2023 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0NIST SP 800-171 Rev. 3 readiness checklist
The NIST SP 800-171 Rev. 3 requirements that matter most for protecting CUI, across all 17 families, mapped to their requirement number, with the evidence an assessor will ask for.
95 items · NIST SP 800-171 Rev. 3 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0NIST CSF 2.0 readiness checklist
The NIST CSF 2.0 outcomes an organization should be able to show across Govern, Identify, Protect, Detect, Respond and Recover, mapped to their subcategory ID, with the evidence a reviewer will ask for.
93 items · NIST CSF 2.0 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0PCI DSS v4.0.1 readiness checklist
Every PCI DSS v4.0.1 requirement a merchant or service provider has to act on, mapped to its requirement number, with the evidence an assessor will ask for.
97 items · PCI DSS v4.0.1 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0NIS 2 readiness checklist
Every NIS 2 obligation an essential or important entity has to act on, mapped to its article and, for digital providers, to Implementing Regulation (EU) 2024/2690, with the evidence a competent authority will ask for.
74 items · NIS 2 Directive (EU) 2022/2555 · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0CMMC Level 2 readiness checklist
The CMMC Level 2 practices a defense contractor handling CUI has to meet, mapped to their practice ID and NIST SP 800-171 Rev. 2 requirement, with the evidence an assessor will ask for.
117 items · CMMC Level 2 (32 CFR Part 170) · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0ISO 9001:2015 readiness checklist
Every ISO 9001:2015 clause a quality management system has to address, mapped to its clause number, with the evidence a certification auditor will ask for.
67 items · ISO 9001 2015 (with 2024 climate amendment) · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0CCPA and CPRA readiness checklist
Every CCPA and CPRA obligation a business has to act on, mapped to its Civil Code section or CCPA regulation, with the evidence the California Privacy Protection Agency or Attorney General will ask for.
61 items · CCPA as amended by CPRA · reviewed 30 Oct 2026
Preview checklist →
PDF · v1.0PIPEDA readiness checklist
Every PIPEDA obligation an organization has to act on, mapped to its fair information principle or section, with the evidence the Office of the Privacy Commissioner will ask for.
66 items · PIPEDA S.C. 2000, c. 5 · reviewed 30 Oct 2026
Preview checklist →