Compliance Checklist — Template

Field	Details
Regulation / Standard	GDPR / SOC 2 / HIPAA / PCI-DSS / ISO 27001 / custom
Scope	What systems, products, or processes are covered
Assessor
Assessment Date	YYYY-MM-DD
Next Review	YYYY-MM-DD
Overall Status	In Progress

Where do we stand? How many requirements are met, how many have gaps, and what's the plan to close them?

One row per requirement. Keep it scannable — the detail goes in the evidence, not in this table.

ID	Requirement	Status	Evidence	Notes
R-001	What the regulation requires	Compliant	Link to evidence or control
R-002		Compliant
R-003		Partial		What's missing
R-004		Gap
R-005		N/A		Why N/A

For every Gap or Partial item above, what's the plan to fix it?

Req ID	Gap	Remediation	Owner	Deadline	Status
R-003	What's missing or incomplete	Specific action to close the gap		YYYY-MM-DD	In Progress
R-004				YYYY-MM-DD	Not Started

Requirements you've decided to accept rather than remediate. Document the business justification and the approver — auditors will ask.

Req ID	Exception Rationale	Risk Accepted By	Review Date
	Why we're not remediating and the residual risk	Name and title	YYYY-MM-DD

Date	Type	Findings	Status
YYYY-MM-DD	Internal / External / Self-assessment	Summary of findings	Closed
YYYY-MM-DD			Open

Training	Audience	Frequency	Last Completed	Next Due	Status
Security awareness	All employees	Annual	YYYY-MM-DD	YYYY-MM-DD	Current
Data handling	Engineering + Support	Annual	YYYY-MM-DD	YYYY-MM-DD	Current
Regulation-specific	Relevant teams	As needed	YYYY-MM-DD	YYYY-MM-DD	Due

Compliance Checklist Template