Compliance Readiness Assessment
A guided assessment of your organization's governance maturity across policy documentation, control mapping, audit evidence, risk register, access governance, vendor governance, and incident response readiness. No system access required.
Free to use · no account required
Compliance Readiness Assessment
Work through each section at your own pace. All questions include operational context and specific next steps. Results are shown immediately — no email required.
Compliance Readiness
Compliance Readiness Assessment
A guided review of your organization's governance maturity across seven areas relevant to SOC 2, HIPAA, and NIST CSF — policy documentation, control mapping, audit evidence, risk register, access governance, vendor governance, and incident response readiness. Work through each section at your own pace — results are shown immediately.
How It Works
What this tool does with your input
How this tool works, and what happens to what you enter
- You
You answer scoped questions
Short, concrete questions about how your environment is actually configured — not a quiz.
- The tool
Scoring runs in your browser
Your answers are evaluated locally against a published baseline — no tenant access, no agent, no connection to your systems.
- You
You get a prioritised gap list
Where you stand by area, with the sequence to address it.
What To Look For
Six Indicators of Compliance Readiness
These are the most common gaps found in compliance readiness assessments, regardless of which specific framework applies.
Undocumented Policies
Policies that exist only informally, in staff memory, are treated as absent by most auditors. Documented, approved, and communicated policy is the foundation every other control area depends on.
No Framework-to-Control Mapping
Reasonable security practices that were never explicitly mapped to your framework's specific requirements leave genuine gaps invisible until an audit surfaces them.
No Risk Register
Most growth-stage organizations have never formally documented risks with likelihood, impact, and ownership — a foundational artifact nearly every framework expects.
Reactive Evidence Collection
Evidence gathered only in the weeks before an audit tends to be incomplete. Evidence captured as part of routine operations is more complete and less stressful to produce.
Access Governance Gaps
Overly broad default access and delayed offboarding are among the most commonly cited audit findings, and among the most straightforward to remediate with a review cadence.
Untested Incident Response
A documented incident response plan that has never been exercised through a tabletop or simulation is a document, not a demonstrated capability.
What This Assessment Covers
Seven Areas of Compliance Governance
Each section addresses a distinct dimension of governance maturity — from policy documentation to incident response readiness.
Policy Documentation
Whether core policies are formally documented, approved by leadership, and reviewed on a defined cadence.
Framework Control Mapping
Whether your applicable framework is identified and controls are explicitly mapped to its requirements.
Audit Evidence Management
Whether evidence is inventoried, collected as part of routine operations, and retained per a defined policy.
Risk Register
Whether risks are formally documented with likelihood, impact, ownership, and a treatment decision.
Access Control Governance
Whether access follows least-privilege principles, is periodically reviewed, and revoked promptly on departure.
Vendor & Third-Party Governance
Whether vendor agreements are reviewed, a vendor inventory is maintained, and critical vendor contingencies are documented.
Incident Response Readiness
Whether an incident response plan exists, has been tested, and maps to applicable breach notification requirements.
Why Compliance Governance Matters
Compliance Is an Operating Discipline, Not a Deliverable
Organizations that treat compliance as a one-time project repeat the same scramble at every audit cycle. Sustainable readiness requires ongoing governance.
Undocumented Policy Is Treated as No Policy
An auditor cannot examine a practice that exists only informally. Formal documentation, leadership approval, and staff acknowledgment are what convert an internal habit into evidence an auditor will accept.
A Risk Register Is Foundational, Not Optional
Nearly every framework expects a documented risk register with assigned ownership and treatment decisions. Its absence is one of the most common and most straightforward-to-remediate findings in a compliance gap assessment.
Evidence Requests Should Be a Retrieval, Not a Scramble
When evidence collection is built into routine operations rather than reconstructed before each audit, evidence requests become a retrieval exercise from an existing inventory rather than a time-pressured reconstruction effort.
Vendor Risk Is Your Risk
Auditors increasingly treat third-party vendors with access to sensitive data as an extension of your own control environment. A documented vendor inventory and review process closes a gap that is otherwise invisible until a vendor incident occurs.
FAQ
Common Questions
Does this tool access our systems or submit data anywhere?
No. This is a structured self-assessment questionnaire — it does not connect to any system, platform, or tenant. You review each question against your organization's current governance practices and select the response that best reflects reality.
Which compliance frameworks does this assessment cover?
The questions are written to apply across SOC 2, HIPAA, and NIST CSF, since the underlying governance disciplines — documented policy, control mapping, evidence management, and risk register maintenance — are common to all three. Framework-specific control detail is addressed during a dedicated compliance engagement.
What is a risk register and why does this assessment ask about it?
A risk register is a documented inventory of identified risks with likelihood, impact, and remediation ownership. Most compliance frameworks expect one, and most growth-stage organizations have never formally produced one — making it one of the most common gaps this assessment surfaces.
We are not in a regulated industry — is this assessment still relevant?
Yes. Organizations pursuing SOC 2 for customer trust, or preparing for due diligence ahead of a funding round or acquisition, engage in this kind of governance work just as frequently as HIPAA-regulated healthcare organizations.
What is the difference between a control gap assessment and this self-assessment?
This tool is a directional self-assessment intended to surface likely gap areas quickly. A formal control gap assessment involves detailed control-by-control mapping against your specific framework, typically conducted as part of a dedicated compliance readiness engagement.
How does audit evidence management differ from just having good security practices?
Good security practices without a maintained evidence inventory still create audit risk — auditors expect to see documented, retrievable proof that controls were operating over time, not just that they exist today. Evidence management is what turns practice into audit-ready proof.
Why does vendor governance appear in a compliance assessment?
Nearly every major compliance framework explicitly requires third-party risk management. Vendors with access to sensitive data or critical systems are treated as an extension of your own control environment by most auditors.
Related Operational Guidance
Backup governance, recovery testing, and retention alignment relevant to most compliance frameworks.
Identity, access, and retention governance across your Microsoft 365 tenant.
Policy documentation, framework alignment, audit evidence, and risk register management.
Documentation, change control, and accountability that underpin sustainable compliance.
A real engagement addressing identity and retention governance gaps in a regulated environment.
A real engagement mapping vendor dependencies and formalizing risk governance.
Operational Support
Need help closing compliance governance gaps?
IT KORR can document your policies, map controls to your applicable framework, build your risk register, and establish sustainable audit evidence practices.
No commitment required — we respond within one business day.