Template Overview

Achieving security certifications like SOC 2 Type II or ISO 27001 requires rigorous control verification across human resources, infrastructure, code review, and cryptography. The Compliance Readiness Checklist provides an auditable matrix that maps regulatory trust criteria to verifiable technical controls and policy documents in plain Markdown.

Markdown Template Structure

Copy the block below or click Download .md File to add this template directly to your personal vault:

---
title: "Compliance Readiness: [Audit Standard e.g., SOC 2 Type II]"
date_evaluated: [YYYY-MM-DD]
compliance_officer: "[[Security & Compliance Lead]]"
target_framework: "SOC 2 Type II / ISO 27001 / GDPR"
audit_window: "2026-Q4 External Audit"
overall_readiness_score: "92%"
controls_passing: 24
controls_remediating: 2
tags: [compliance, security, soc2, gdpr, audit-readiness, governance]
---

# Compliance Readiness Checklist — [Audit Standard]

## 1. Audit Scope & Organizational Boundaries
- **Target Certification:** SOC 2 Type II (Security, Confidentiality, and Availability Trust Criteria).
- **In-Scope Systems:** Local desktop application, website documentation portal, and code build pipeline.
- **Architectural Advantage:** Since the desktop client operates 100% on-device with zero user data ingestion, cloud data store controls are marked 'Not Applicable / Out of Scope by Design'.

## 2. Security & Privacy Controls Verification Matrix
| Control ID | Trust Criteria | Required Policy / Evidence | Implementation Status | Evidence Reference |
|---|---|---|---|---|
| **CC-1.1** | Security Governance | Published Information Security Policy | **Compliant** | `docs/policies/infosec-v2.md` |
| **CC-2.1** | Employee Offboarding | Automated 24-hr access revocation | **Compliant** | Identity provider audit log |
| **CC-5.2** | Secure Code Review | Mandatory 2-person signoff on PRs | **Compliant** | GitHub branch protection rules |
| **CC-6.1** | Logical Access Control | Hardware 2FA keys enforced for all staff | **Compliant** | WebAuthn enforcement report |
| **CC-6.6** | Data In-Transit Encryption | TLS 1.3 enforced for website edge | **Compliant** | SSL Labs A+ rating report |
| **CC-7.1** | Vulnerability Scanning | Automated dependency vulnerability audits | **Remediating** | Dependabot alerts active |

## 3. Remediations in Progress
### Control CC-7.1: Dependency Vulnerability SLA
- **Identified Gap:** Two non-exploitable transitive npm devDependencies have pending security patches older than 14 days.
- **Remediation Action:** Upgrade build dependencies and lock version in `pnpm-lock.yaml`.
- **Target Completion:** 2026-10-15 (Lead: `[[DevOps Lead]]`).

## 4. GDPR & Data Sovereignty Verification
- **Right to Erasure (Article 17):** Fully satisfied. User data resides in local Markdown files on the user's Mac; deleting the folder permanently destroys all data with zero server remnants.
- **Cross-Border Data Transfer (Chapter V):** Non-applicable. Zero audio or transcript packets cross international borders.

## 5. Auditor Sign-Off Readiness
> [!IMPORTANT] Readiness Assessment: APPROVED FOR AUDIT
> The organization demonstrates 92% control readiness. Completing the dependency upgrades will satisfy all primary Trust Services Criteria.

## 6. Action Items
- [ ] Export branch protection settings evidence.
- [ ] Conduct mock interview with external compliance auditor.

Filled Real-World Example

Here is a realistic example demonstrating how this template captures actual deliberations:

---
title: "Compliance: SOC 2 Readiness"
date_evaluated: 2026-10-07
compliance_officer: "[[Elena Rostova]]"
target_framework: "SOC 2 Type II"
overall_readiness_score: "96%"
tags: [compliance, soc2]
---

# Compliance Readiness Checklist — SOC 2 Readiness

## 1. Audit Overview
Elena Rostova conducted the pre-audit review for SOC 2 Type II certification.

## 2. Finding
All access controls and code signing workflows passed verification. Zero server data storage simplifies the Confidentiality criteria substantially.

When to Use and When to Avoid

When to Use

  • Use during pre-audit preparations for SOC 2, ISO 27001, HIPAA, or GDPR reviews.
  • Use to maintain a continuous, living security posture ledger throughout the year.
  • Use to prove to enterprise B2B customers that security controls are rigorously verified.

When to Avoid

  • Avoid using as a casual weekly developer to-do list.
  • Avoid omitting evidence links (auditors require verifiable artifacts).

On-Device AI Integration

Summarize your recording in Oyma with this local instruction:

Analyze the security policy documents and infrastructure settings:
1. Map current technical practices against SOC 2 Trust Services Criteria.
2. Identify compliance gaps or missing audit evidence logs.
3. Generate a structured Markdown compliance readiness checklist with remediation assignments.

Your data remains securely on your Mac with zero cloud exposure.

Frequently Asked Questions

What is compliance readiness in software engineering?

The systematic process of auditing internal security controls, data privacy policies, and operational processes against formal regulatory frameworks (SOC 2, ISO 27001, HIPAA, GDPR) prior to external audits.

How does local-first architecture simplify compliance?

Because audio recordings and Markdown notes stay exclusively on user local hardware, requirements for cloud database encryption, multitenancy isolation, and cross-border data transfer are rendered moot.

Can audit evidence links be embedded in Markdown?

Yes. This template links directly to local policy files, code commits, and test outputs required by compliance auditors.