Compliance Checklist

A framework-agnostic checklist for standing up a compliance program from scratch, whichever certification you're pursuing.

Identify which frameworks apply
Map your customers, data types, and geographies to the frameworks you actually need: SOC 2, ISO 27001, HIPAA, GDPR, and others.
Assign a program owner
Name someone accountable for compliance, even part-time. Programs without an owner stall.
Scope the program
Define which systems, teams, and data are in scope so effort goes where it matters.
Run a risk assessment
Identify and score risks by likelihood and impact, then map controls to each one.
Write your core policies
Security, access control, incident response, and acceptable use, in plain language your team will actually follow.
Implement controls
Access management, encryption, logging, monitoring, and vendor review across your environment.
Automate evidence collection
Capture evidence continuously so you're always audit-ready, not scrambling once a year.
Run an internal review
Test your own controls before an auditor does, and remediate what's weak.
Undergo the audit or attestation
Engage an independent auditor where the framework requires it.
Monitor continuously
Compliance is ongoing. Keep evidence fresh as systems, people, and vendors change.