# Compliance readiness checklist

Twenty-five checks across SOC 2, HIPAA, PCI DSS, CMMC and the basics.

## How to use it

Mark each line done, partly done or not started. Start with the framework your client, regulator or insurer names. Every framework asks for the basics, so finish those too.

## SOC 2 readiness

- Security policies and procedures are written down.
- Access control and identity management are in place.
- Changes to systems follow a written process.
- Incidents are monitored, and a response plan exists.
- Vendor risk is reviewed before a vendor gets data.

## HIPAA basics

- A risk assessment is done and written down.
- Business Associate Agreements (BAAs) are signed with every vendor that touches patient data.
- Patient data is encrypted at rest and in transit.
- Staff are trained, and the training is recorded.
- Breach notification steps are written down.

## PCI DSS

- The systems that hold card data are scoped and written down.
- The network is segmented, and firewall rules are kept.
- Stored and transmitted card data is encrypted.
- Vulnerabilities are scanned and systems are patched.
- Access is logged and the logs are watched.

## CMMC Level 1

- Basic access control is in place.
- Every user and device is identified and authenticated.
- Media is protected and wiped before disposal.
- Physical access to systems is controlled.
- Systems and communications are protected at the network edge.

## Basic security hygiene

- MFA is on for every account that offers it.
- Backups run on a schedule, and a restore has been tested.
- Every device runs managed endpoint protection.
- Staff take security awareness training.
- An up-to-date list of devices and software is kept.

---

SBK Consulting · Version 1.0, August 2026 · https://sbkconsultants.com/resources/compliance-readiness-checklist/