5 free templates
SOC 2, ISO 27001, HIPAA, and NIST evidence trackers, gap assessments, and audit request logs.
Each one is free as a print-ready PDF, and most include an editable CSV. One form unlocks the whole library.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Most ISO 27001 gap assessments focus on Annex A and skip clauses 4 to 10, which is backwards: the management system clauses are mandatory and are where certification audits most often find problems.
The Statement of Applicability is the document a certification auditor works from, and the column they actually test is justification, particularly for controls you have excluded. 'Not applicable' without a defensible reason is a finding.
Auditors test three things about policies: that they exist, that they are approved by someone with authority, and that they are reviewed. The register answers all three in one page, which is why it is usually the first artefact requested.
Audit fieldwork goes badly when requests are tracked in email. Items get missed, two people produce the same artefact differently, and nobody can say what is outstanding, which is itself read as a control weakness.
