The per-control checklist people keep saying doesn't exist: what auditors actually ask for under the Security TSC, and how to collect each item — with the failure modes that cost small teams months.
Why we made this
Threads asking for exactly this keep appearing: "there isn't a universal evidence checklist." There isn't a perfect one, but most small SaaS teams need the same 80% — and that 80% can be written down. So we did.
This is self-assessment material, not audit advice. Your auditor decides what's sufficient.
Want the fuller toolkit?
The paid toolkit adds the full control matrix, twelve editable policies, gap-analysis walkthrough, monthly review and risk register templates, GitHub evidence scripts, and sample outputs.
See the paid toolkit