1
Evidence, not intent
Every control row carries the artifact the auditor requests — the export, the report, the log window — because a control that ran all period but produced nothing still fails the test.
What This Resource Includes
A control list organised around the evidence request rather than the control name, so preparation runs backwards from the audit date instead of forwards from a policy.
2
A 15-item evidence register
Which artifact, how many rows, what observation window, and how to produce it. Use it to work backwards from the audit date.
3
Mapped three ways
Each domain maps to SOC 2 Trust Services Criteria, ISO/IEC 27001:2022 Annex A clause numbers and NIST SP 800-53 Rev.5, so one checklist serves both audits.
The Failures are Procedural, Not Technical
Endpoint controls rarely fail an audit because they were absent. They fail because coverage was measured against the managed device list instead of the real device population, because nobody exported the artifact inside the observation window, or because the evidence sat on a laptop that had already been reissued. Verizon’s 2025 Data Breach Investigations Report found 46% of infostealer-compromised systems holding corporate logins were unmanaged devices — the population most coverage figures quietly leave out.
- Coverage measured against the real device population, with the unmanaged remainder listed as a control in its own right.
- A month-by-month worked example showing which rows fire, and what a policy pack alone would have produced instead.
- Owner, target date, status and risk on every row, with completion tracked live at the top of the sheet.
- Clause numbers and control identifiers only — no standards text is reproduced, so the file is safe to circulate internally.
