Compliance Readiness Checklist

Free Compliance Readiness Checklist for SOC 2, HIPAA and CMMC

Most compliance projects fail in the same place: nobody can say, in a sentence, how far along the organisation actually is. Leadership asks “are we ready for the audit?” and the honest answer is a shrug. This compliance readiness checklist replaces the shrug with a number. You pick the frameworks you are working toward, answer a structured set of control questions, and get a weighted readiness score per framework, a category-by-category breakdown, a ranked list of gaps, and a remediation plan you can hand to whoever owns the work.

It is built for the person who has been handed compliance on top of an existing job — the IT manager at a 40-person clinic, the first security hire at a Series A SaaS company, the operations lead at a defence subcontractor who just found the word CMMC in a new contract. It is not an audit, and it does not issue a certificate. It is the thing you do before you spend money on an auditor, so that the auditor’s findings are not a surprise.

Which Frameworks the Checklist Covers

You can assess against one framework or several at once. Because the underlying controls overlap heavily, answering a question about access reviews scores against SOC 2, HIPAA and CMMC simultaneously rather than making you answer it three times.

How to Use the Checklist

1. Build your profile. Industry, headcount band, current status (nothing yet, in progress, already certified), target date, and three flags that change which questions matter: do you handle payment data, protected health information, or personal data?
2. Select your target frameworks. Pick one to start with if you are new to this. Pick several if you are trying to see where a single control programme can satisfy multiple auditors at once.
3. Answer the control questions. Each has four responses — Yes (fully implemented and documented), Partial (implemented but incomplete), No (not implemented), and N/A. Partial credit is real: it scores 0.5, so a half-built control does not look identical to a missing one.
4. Read the scores. You get an overall percentage, a score per framework, and a score per control category, so you can see whether your weakness is concentrated (incident response is a hole) or spread evenly (everything is at 60%).
5. Work the gap list. Gaps are ranked by priority, and each carries a plain-language description of the problem, a concrete fix, an effort estimate in hours/days/weeks/months, and a rough cost band.
6. Export the report. The PDF is formatted for circulation — scores, category breakdown, gap register and ranked remediation plan — which is usually what a board or a customer’s security reviewer actually wants to see.

How the Readiness Score Is Calculated

Not every control carries equal weight, so a straight percentage of “yes” answers would be misleading. Each question has a priority (critical, high, medium, low) and a weight, and the score is the weighted sum of your answers divided by the weighted maximum for the questions that apply to you. Questions answered N/A drop out of both the numerator and the denominator rather than counting as failures.

Results land in one of five readiness bands:

• 0–25% Not Ready — foundational controls are missing. An audit at this stage wastes money.
• 26–50% Early Stage — some controls exist but there is no coherent programme yet.
• 51–75% In Progress — the shape of a programme is visible; the work now is evidence and consistency.
• 76–90% Nearly Ready — close enough to schedule a readiness assessment with a firm.
• 91–100% Audit Ready — remaining items are refinements rather than blockers.

Critical gaps are counted and surfaced separately, because a single missing critical control — no risk analysis, no incident response plan, no access reviews — will sink an audit regardless of how good the average looks.

The Control Families the Questions Map To

Questions are grouped into categories that mirror how auditors actually structure fieldwork, and each question carries its own mapping to specific clauses in the frameworks it touches.

• Policies and governance — code of conduct, board oversight, documented and approved security policies. Maps to SOC 2 CC1 (Control Environment) and CC2 (Communication and Information).
• Risk management — documented risk assessment methodology, a maintained risk register, treatment decisions. Maps to SOC 2 CC3 and, for HIPAA, the risk analysis and risk management specifications at 45 CFR 164.308(a)(1)(ii)(A) and (B), both of which are Required rather than addressable.
• Access control — provisioning and deprovisioning, least privilege, periodic access reviews, MFA. Maps to SOC 2 CC6, HIPAA 164.308(a)(4) and 164.312(a), and CMMC access control practices.
• Data protection — classification, encryption at rest and in transit, key management, secure disposal.
• Vulnerability management — scanning cadence, patch SLAs, penetration testing.
• Incident response — a documented plan, defined roles, tested at least annually, with notification obligations mapped. Maps to SOC 2 CC7, HIPAA 164.308(a)(6), and the GDPR 72-hour supervisory-authority notification if you also process EU personal data.
• Business continuity — backups, restore testing, disaster recovery and emergency mode operation. HIPAA makes the data backup plan, disaster recovery plan and emergency mode operation plan Required specifications under 164.308(a)(7).
• Vendor management — due diligence, contractual security terms, and for HIPAA, a signed Business Associate Agreement with every vendor that creates, receives, maintains or transmits PHI on your behalf.
• Training and awareness, physical security, and audit and monitoring — the areas most often missing evidence rather than missing controls.

Where Multi-Framework Assessment Pays Off

The strongest argument for assessing several frameworks together is that the overlap is enormous. An access review procedure with documented evidence satisfies a SOC 2 CC6 criterion, a HIPAA information access management specification, and a CMMC access control practice at the same time. Encryption of data in transit shows up in every framework on the list. Once you can see the overlap, the compliance budget conversation changes from “we need three programmes” to “we need one programme with three sets of evidence.”

The divergences matter too, and they are where scores usually differ most. HIPAA is unusual in labelling many implementation specifications “addressable” rather than required — encryption of ePHI at rest under 164.312(a)(2)(iv) and in transmission under 164.312(e)(2)(ii) are both addressable, meaning you must implement them or document why an equivalent alternative is reasonable. A proposed 2025 update to the Security Rule would remove that flexibility, but as of mid-2026 it has not been finalised, so the current rule still applies. CMMC, by contrast, has no such flexibility: for Level 2 the requirements come from NIST SP 800-171 and are assessed as met or not met.

Frequently Asked Questions

Is this checklist a substitute for a real audit?

No. It is a self-assessment. SOC 2 attestation must be performed by a licensed CPA firm, ISO 27001 certification by an accredited certification body, and CMMC Level 2 assessments by an authorised C3PAO or, for some contracts, by self-assessment with an affirming official. This tool tells you where you stand before you engage any of them.

Is any of this legal advice?

No. Everything here is an informational aid. Framework requirements are interpreted in context, and your obligations depend on your contracts, your jurisdiction and the specific data you handle. Confirm anything consequential with qualified legal or compliance counsel before acting on it.

How long does the assessment take?

Roughly 20–45 minutes for a single framework, longer if you select several. The realistic constraint is not the clicking — it is that some questions need input from whoever runs HR onboarding, whoever owns the vendor contracts, and whoever holds the backup schedule.

What score do I need before booking an audit?

There is no official threshold, because the score is ours rather than the framework’s. As a practical rule, below 75% you are buying an expensive gap list; above 90% with no open critical gaps you are in reasonable shape for a readiness assessment.

Does answering N/A hurt my score?

No. N/A removes the question from the calculation entirely rather than scoring it as zero. Use it honestly — marking real gaps as N/A produces a flattering score and a failed audit.

Which framework should a startup do first?

Usually whichever one is blocking a deal. SOC 2 is the common answer for B2B SaaS because enterprise buyers ask for the report. If you handle PHI you do not get to choose — HIPAA applies by law. Start narrow with our SOC 2 gap analysis or the HIPAA quick assessment if you want a faster first pass.

What do I do with the gaps once I have them?

Work top-down by priority, and start with the ones that are documentation rather than engineering — written policies close a surprising share of critical gaps in a week. The security policy generator produces the acceptable use, password, access control, incident response, remote work and data classification policies most frameworks expect.

Does my data leave the browser?

Your answers stay in your browser and are used to calculate scores and build the exported report locally. Nothing is submitted to us for storage, and there is no account to create.

How often should I reassess?

At least annually, and again after anything that changes your control environment: a new product line, a major vendor change, an acquisition, or a shift to a new hosting model. If you want a broader view of the security programme rather than a single framework, the cybersecurity maturity assessment covers the same ground from a capability angle.