Work through five domains: access governance, continuous monitoring, documentation, vendor risk, and incident response, and mark exactly where your evidence exists and where it doesn't. That's the same list an auditor works from.
HIPAA penalties climb from $141 per violation to more than $2.1 million per category for willful neglect. PCI DSS fines run $5,000 to $100,000 a month. A CMMC gap closes DoD contracts outright. This checklist puts a number next to the risk before you're negotiating with an auditor instead of preparing for one.
Fixing access controls without documenting them still leaves a finding open. This checklist orders the five domains so each fix holds up under the one that comes after it, starting with documentation and ending with the monitoring and incident response work a two-person team usually can't staff alone.
