Official Document

Sprint Readiness Checklist

This document defines exactly what "audit-ready" means for your Compliance Sprint. No ambiguity. No subjectivity. Just clear, measurable criteria.

How This Works

Shared Document

Both you and your ComplianceOS manager have access to this checklist throughout the sprint.

Objective Criteria

Each item is binary: done or not done. No "mostly done" or "good enough."

Sign-Off

At Day 30, we review together. All items must be checked. If any aren't, we fix them or refund you.

Audit-Readiness Criteria

All items must be marked complete for the sprint to be considered delivered.

🔍

1. Gap Analysis

Complete gap analysis performed against target framework (SOC 2 or ISO 27001) All controls assessed and scored (met / partially met / not met) Risk scoring completed for each gap (critical / high / medium / low) Readiness score calculated and documented (target: ≥80%) Gap analysis report delivered to client

📋

2. Policy Documentation

All required policies for target framework written and customized Policies mapped to specific framework controls Policies reviewed and approved by client stakeholders Policy version control established in ComplianceOS Policy acknowledgment workflow configured (for employee sign-off)

🗺️

3. Control Mapping

All framework controls mapped to client's specific environment Control owners assigned for each control Control testing procedures documented Multi-framework mapping completed (if applicable)

📸

4. Evidence Collection

Evidence collection system configured in ComplianceOS Automated evidence integrations connected (AWS, GitHub, Jira, Okta, etc.) Evidence collection running for minimum 30 consecutive days Evidence gaps identified and resolved Evidence package exportable in auditor-ready format

🔬

5. Internal Audit (Dry Run)

Internal audit simulating external auditor performed Sample evidence tested for each key control Findings documented with severity ratings Remediation plan created for all findings

🔧

6. Gap Remediation

All critical and high gaps remediated Medium gaps remediated or accepted with documented risk acceptance Remediation evidence collected and stored Post-remediation readiness score ≥85%

⚠️

7. Risk Register

Risk register populated with all identified risks Each risk scored (likelihood × impact) Risk owners assigned Remediation plans documented for all high/critical risks

🎓

8. Team Training & Handoff

Team training session completed (ComplianceOS usage) Auditor prep session completed (what to expect, how to respond) Key contacts documented (who handles what during audit) Escalation procedures documented Client can independently navigate ComplianceOS and export evidence

📦

9. Final Deliverables

Complete gap analysis report delivered All policy documents delivered (PDF + editable format) Control mapping document delivered Remediation roadmap delivered Evidence package exportable and tested ComplianceOS instance fully configured and operational

Sign-Off

At Day 30, both parties review this checklist together. The sprint is considered complete when:

Minimum Threshold

90% of checklist items marked complete AND post-remediation readiness score ≥85%

If Not Met

Full refund issued within 5 business days. Client keeps all deliverables.

ComplianceOS

Name · Signature · Date

Client

Name · Signature · Date

⚡ Exclusions & Clarifications

What's NOT included in "audit-ready":

Passing the actual audit. We get you ready. Passing depends on your auditor's judgment and factors outside our control.
90 days of evidence (SOC 2 Type II). If your auditor requires 90 days of evidence, that takes 90 days to collect. We collect 30 days during the sprint. The remaining 60 days can be collected post-sprint using the system we set up.
Remediation requiring third-party tools. If a gap requires purchasing a new tool (e.g., a SIEM), we'll identify it but purchasing and implementing is on you.
Employee training completion. We train your team. Getting every employee to read and acknowledge policies is your responsibility.

Download PDF Version

Share this with your team. Everyone knows what "done" looks like.