All 47 controls, the evidence each one needs, and the system that owns it. Check items off as you close them, assign an owner to every gap, and watch readiness climb — your progress saves to this browser. Export to CSV, copy to Notion, or print the whole thing.
A practical 47-control set covering the Security criterion in full plus common Availability and Confidentiality additions. Evidence paths show the typical system of record — provider-agnostic by intent. This is a readiness aid, not a substitute for your auditor's control matrix.
Every evidence path in this checklist is something Uproot can watch for you — pulling the live state from AWS, Okta, and GitHub every fifteen minutes and flagging the moment a control drifts. The checklist becomes a dashboard, not a quarterly fire drill.
