Manifestly: A Checklist App for Teams

Compliance Audit Checklist

Audit Scoping & Kickoff

Confirm the in-scope frameworks for this audit

Identify the in-scope systems and data stores

Notify control owners of evidence requests

Access Control Review

Export the active user roster from Entra ID

Verify MFA enforcement and block legacy auth

Run the quarterly user access review

Audit privileged and service accounts

Confirm offboarding ran clean for departures this period

Remediate access control findings

Data Protection & Backup

Confirm encryption at rest on endpoints and servers

Verify TLS configuration on external services

Run the quarterly restore drill

Confirm immutable / air-gapped backup copy

Review DLP alerts and data retention enforcement

Network Security & Vulnerability Management

Review firewall rule base for stale entries

Run authenticated vulnerability scan

Confirm patch compliance across the fleet

Validate network segmentation between zones

Review SIEM coverage and alert tuning

Incident Response Readiness

Confirm IR plan reflects current tooling and contacts

Run a tabletop exercise against a relevant scenario

Review incident tickets from the audit period

Verify breach notification timelines are documented

Policy & Awareness

Confirm policy set is current and approved

Verify security awareness training completion

Review vendor risk and SOC reports on file

Findings & Sign-Off

Compile findings register with severity and owner

Determine whether remediation extends past audit window

Escalate open findings to leadership for sign-off

Sign off on the audit readiness package

Free Checklist Templates for Compliance