Every item on the checklist is phrased as evidence — something you could produce within one business day if a customer, insurer, or funder asked for it tomorrow.
Your device and software inventory, who administers each system, and a map of where customer or patient data actually lives.
MFA, named accounts with no shared logins, your admin list, and proof that leavers lose access the day they leave.
Patching records, endpoint protection coverage, and recent vulnerability results you can hand over, not describe.
A backup schedule is a claim. A dated restore test is evidence. Questionnaires increasingly ask for the second one.
A written response plan, the first phone calls listed, and notes showing the plan has been walked through at least once.
A signed security policy, a current risk assessment, a risk register with owners, and findings shown closed — not just opened.
Training records, phishing-awareness results, and signed acceptable-use acknowledgments for the whole team.
Which vendors can touch your systems or data, the agreements you hold with them, and the reviews you have on file.
Print it or keep it on screen. Work down the list and tick only what you could actually produce within one business day — not what you believe is probably in place.
If the checklist leaves boxes unticked, Clyvara's Risk & Readiness Assessment turns them into a documented risk register and a remediation roadmap — the evidence pack behind every future questionnaire.