Free operational checklists and field notes for ISO standards, cybersecurity frameworks, and privacy regulations.
Filter by framework family or search by standard, audience, or topic.
Information Security · ISO Standards
A structured step-by-step checklist to help internal security teams build an ISMS and prepare for Stage 1 and Stage 2 certification audits.
SaaS Companies, IT & Cloud Service Providers
Trust Services · Cybersecurity & Cloud
An operational checklist for scoping Trust Services Criteria, designing controls, collecting evidence over the observation window, and preparing for a Type II examination.
SaaS, Cloud, and B2B Technology Companies
Privacy Regulation · Data Privacy & Law
A practical checklist for mapping personal data in web applications, establishing lawful bases, honoring data-subject rights, and preparing internal GDPR readiness reviews.
Product, Engineering, and Legal Teams Building Web Apps
Healthcare Privacy · Data Privacy & Law
A Security Rule–oriented checklist to help HealthTech teams safeguard ePHI, complete a risk analysis, implement required and addressable safeguards, and prepare for internal or customer audits.
HealthTech, Digital Health, and Covered-Entity Vendors
Quality Management · ISO Standards
A clause-aligned checklist to help teams establish a Quality Management System, demonstrate process control, and prepare for ISO 9001:2015 Stage 1 and Stage 2 audits.
Quality Managers, Operations Leaders, and Growing Product Organizations
Payments · Cybersecurity & Cloud
A requirement-by-requirement checklist to scope cardholder data, implement PCI DSS v4.0.1 controls, and prepare for SAQ or ROC evidence.
Merchants, Payment Processors, and SaaS Billing Teams
NIST CSF · Cybersecurity & Cloud
A function-by-function checklist for Govern, Identify, Protect, Detect, Respond, and Recover under NIST CSF 2.0.
CISOs, Public-Sector, and Enterprise Security Programs
CMMC · Cybersecurity & Cloud
A practice-oriented checklist to protect CUI, implement NIST 800-171 requirements, and prepare for a CMMC Level 2 assessment.
US Defense Contractors and CUI Processors
NIST 800-53 · Cybersecurity & Cloud
A control-family checklist to implement a Moderate baseline, produce a security package, and prepare for assessment.
Federal Systems, GovCloud Vendors, and High-Assurance SaaS
CIS Controls · Cybersecurity & Cloud
A Safeguard-oriented checklist to implement CIS Controls v8 by Implementation Group, from IG1 hygiene through IG3 enterprise.
IT Teams Building a Foundational Cyber Program
FedRAMP · Cybersecurity & Cloud
A package-oriented checklist to prepare a Moderate FedRAMP authorization: boundary, 3PAO assessment, and ConMon.
Cloud Service Providers Selling to US Federal Agencies
PIMS · ISO Standards
A controller/processor checklist to implement a Privacy Information Management System as an extension to ISO 27001.
Teams Extending ISO 27001 with Privacy Controls
Continuity · ISO Standards
A BCMS checklist covering BIA, strategies, plans, exercises, and Stage 1/2 readiness for ISO 22301.
Operations, Risk, and Resilience Leaders
Environment · ISO Standards
A clause-aligned EMS checklist for aspects, compliance obligations, operational control, and ISO 14001 audit readiness.
EHS Managers and Manufacturing / Facilities Teams
OH&S · ISO Standards
An OH&S MS checklist for hazard identification, worker participation, operational control, and ISO 45001 readiness.
EHS, HR, and Operations Leaders
AI Governance · ISO Standards
An AIMS checklist for AI policy, impact assessment, lifecycle controls, and ISO 42001 audit readiness.
AI Product, Risk, and Compliance Teams
Cloud ISO · ISO Standards
A cloud-control checklist based on ISO 27017 guidance for shared-responsibility, virtualization, and customer/provider duties.
Cloud Service Providers and Cloud Customers
Cloud Privacy · ISO Standards
A cloud-privacy checklist for PII processors: purpose limitation, customer control, return/deletion, and 27018 controls.
SaaS and IaaS Providers Processing Customer PII
ITSM · ISO Standards
An SMS checklist for service catalogue, SLAs, change, incident, and ISO 20000-1 audit readiness.
IT Service Owners and Managed Service Providers
MedTech QMS · ISO Standards
A medical-device QMS checklist for design controls, production, CAPA, and ISO 13485 audit readiness.
Quality and Regulatory Teams in Medical Devices
Anti-Bribery · ISO Standards
An ABMS checklist for bribery risk assessment, due diligence, financial controls, and ISO 37001 readiness.
Compliance, Legal, and Ethics Officers
Risk · ISO Standards
A principles-and-process checklist to embed ISO 31000 risk management across strategy, operations, and reporting.
Enterprise Risk, Audit, and Executive Teams
Energy · ISO Standards
An EnMS checklist for energy review, baselines, SEUs, operational control, and ISO 50001 audit readiness.
Facilities, Sustainability, and Operations Teams
Automotive · ISO Standards
An automotive QMS checklist covering IATF 16949 customer-specific requirements, core tools, and audit readiness.
Automotive Suppliers and Quality Managers
California Privacy · Data Privacy & Law
A CPRA-oriented checklist for notices, consumer rights, service providers, and 2026 CPPA regulation readiness.
Product, Legal, and Privacy Teams Serving California Residents
NIS2 · Data Privacy & Law
An Article 21-oriented checklist for governance, risk, incident reporting, and supply-chain measures under NIS2.
Essential and Important Entities in the EU
DORA · Data Privacy & Law
A DORA checklist for ICT risk management, incident reporting, resilience testing, and ICT third-party registers.
EU Financial Entities and Critical ICT Providers
EU AI Act · Data Privacy & Law
A role-and-risk checklist for prohibited practices, GPAI duties, high-risk Annex III systems, and transparency.
AI Product, Legal, and Risk Teams Placing AI on the EU Market
Cookies · Data Privacy & Law
A consent-UX checklist for cookies, SDKs, and tracking: notices, prior consent, rejection ease, and records.
Web, Marketing, and Privacy Engineering Teams
DPIA · Data Privacy & Law
A step-by-step DPIA checklist: screening, necessity, risks to rights, mitigations, and DPO/consultations.
Privacy, Security, and Product Teams Launching High-Risk Processing
UK GDPR · Data Privacy & Law
A UK-focused privacy checklist covering ICO expectations, UK GDPR, DPA 2018, and PECR cookies.
Organizations Offering Goods or Services in the UK
LGPD · Data Privacy & Law
An LGPD checklist for legal bases, DPO (encarregado), rights, and ANPD incident expectations.
Companies Processing Personal Data of Individuals in Brazil
HITRUST · Cybersecurity & Cloud
A HITRUST r2/e1/i1-oriented checklist for scoping, control implementation, validated assessment, and interim testing.
HealthTech and Enterprises Facing HITRUST Customer Demands
TISAX · Cybersecurity & Cloud
A TISAX checklist based on VDA ISA: scoping labels, controls, and audit provider readiness.
Automotive Suppliers Handling OEM Prototype or Personal Data
SOC 1 · Cybersecurity & Cloud
A SOC 1 checklist for control objectives relevant to user entities’ internal control over financial reporting.
Payroll, Payments, and Other ICFR-Relevant Service Organizations
Cyber Essentials · Cybersecurity & Cloud
A Cyber Essentials / Plus checklist for boundary firewalls, secure config, access control, malware, and patching.
UK SMEs and Suppliers to UK Government
Incident Response · Cybersecurity & Cloud
A NIST-aligned IR checklist for preparation, detection, containment, eradication, recovery, and lessons learned.
SOC, CISO, and Legal Teams
TPRM · Cybersecurity & Cloud
A third-party risk checklist for inherent-risk tiering, due diligence, contracts, and continuous monitoring.
Procurement, Security, and Privacy Teams
DR / Backup · Cybersecurity & Cloud
A recovery checklist for 3-2-1 backups, immutability, restore tests, and ransomware-ready DR.
IT Operations, SRE, and Business Continuity Owners
AppSec · Cybersecurity & Cloud
An ASVS-oriented checklist to verify authentication, access control, cryptography, and API security before release.
Engineering, AppSec, and Product Security Teams
Cloud Security · Cybersecurity & Cloud
A CSP-agnostic checklist for tenant IAM, logging, encryption, network, and well-architected security pillars.
Cloud Architects, Security, and Platform Teams
PAM · Cybersecurity & Cloud
A PAM checklist for admin-tiering, just-in-time access, vaulting, and standing-privilege reduction.
Identity, Infrastructure, and Security Operations Teams
Vuln Mgmt · Cybersecurity & Cloud
A VM checklist for asset coverage, SLA by severity, exception handling, and scanner-to-ticket workflow.
Security Operations and Platform Engineering
Pentest · Cybersecurity & Cloud
A pre-engagement checklist for scoping, rules of engagement, environments, and remediating findings.
Security, Engineering, and Vendor-Management Teams
SOX ITGC · Cybersecurity & Cloud
An ITGC checklist for access, change, and IT operations supporting SOX 404 / ICFR.
Public-Company IT, Finance, and Internal Audit
GLBA · Data Privacy & Law
A Safeguards Rule checklist for written program, risk assessment, access controls, encryption, and qualified individual.
US Financial Institutions and Fintechs under FTC/Banking Agencies
COPPA · Data Privacy & Law
A COPPA checklist for notice, verifiable parental consent, data minimization, and operator duties.
Product Teams with Child-Directed or Mixed-Audience Apps
Accessibility · Data Privacy & Law
A WCAG 2.2 checklist for perceivable, operable, understandable, robust criteria and legal accessibility programs.
Product, Design, and Front-End Teams
PIPEDA · Data Privacy & Law
A PIPEDA checklist mapped to the ten fair information principles, including meaningful consent and breach reporting.
Organizations Handling Canadian Personal Information in Commercial Activity
PDPA · Data Privacy & Law
A PDPA checklist for consent, purpose limitation, DPO, data-breach notification, and PDPC expectations.
Organizations Collecting Personal Data in Singapore
Retention · Data Privacy & Law
A records schedule checklist to set retention periods, automate deletion, and handle backups and legal holds.
Privacy, Legal, IT, and Records Teams
ROPA · Data Privacy & Law
A ROPA checklist to inventory processing activities, recipients, transfers, and retention for Article 30.
Privacy and Legal Operations Teams
Transfers · Data Privacy & Law
A transfer checklist for mapping flows, choosing a Chapter V tool, and completing a Transfer Impact Assessment.
Privacy Counsel and Security Teams Using Non-Adequate Countries
Zero Trust · Cybersecurity & Cloud
A NIST SP 800-207-oriented checklist for identity-centric access, device trust, and eliminating implicit network trust.
Enterprise Architects and Identity Teams
Kubernetes · Cybersecurity & Cloud
A cluster-hardening checklist for RBAC, supply chain, runtime, network policies, and secrets.
Platform, SRE, and Cloud Security Teams
Separate articles for search and context. Each one points to its interactive checklist — they are not the same page.
Information Security
ISO 27001:2022 audit readiness: what Stage 1 and Stage 2 actually test
How to prepare an ISMS for ISO 27001:2022 certification in 2026 — scope, SoA, internal audit, and what registrars sample in Stage 2.
Trust Services
SOC 2 Type II in 2026: observation windows, evidence, and exceptions
A practical guide to SOC 2 Type II — Trust Services Criteria, Type I vs Type II, and how to collect evidence over the observation period.
Privacy Regulation
GDPR for web applications: lawful basis, cookies, and processor chains
How web and SaaS teams operationalize GDPR — ROPA, consent UX, subprocessors, and transfers — without treating the privacy policy as the program.
Payments
PCI DSS v4.0.1 in 2026: ROC scope, SAQ choice, and customized approach
How payment teams prepare for PCI DSS v4.0.1 — cardholder data environment, SAQ vs ROC, and what QSAs sample after the 2025 future-dated requirements.
NIST CSF
NIST CSF 2.0: Govern, profiles, and how to use the framework without a certificate
A 2026 guide to NIST Cybersecurity Framework 2.0 — the new Govern function, current vs target profiles, and how CSF sits next to ISO 27001 and SOC 2.
EU AI Act
EU AI Act in 2026: prohibited, GPAI, high-risk — and who is provider vs deployer
A practical guide to EU AI Act readiness — role classification, high-risk obligations, GPAI documentation, and how it sits next to ISO 42001.
Each guide is structured from publicly available framework clauses and control families so internal teams can run a self-assessment before a formal audit. They are operational references for audit readiness — not a substitute for accredited certification or legal counsel.
The checklists and field notes provided on this website are for educational and informational purposes only. They do not constitute legal, financial, or professional advice. Completing a checklist does not guarantee compliance, certification, or immunity from audits. Always consult with a certified auditor or legal counsel for your specific organizational needs.