Control evidence readiness checklist

Prepare the evidence set\n\nBefore assessing a control checklist, gather the policies, standards and artifacts that are actually approved and current. Typical categories include access control, change management, incident response, backups, security training, vulnerability management, vendor risk and data handling.\n\n### Evidence categories\n\n- Policy or standard\n- Procedure\n- Technical configuration evidence\n- Review record\n- Training record\n- Audit or certification evidence when actually valid\n\nThe output should distinguish supported, partial and unsupported requirements. It should not claim audit readiness, certification or legal compliance without direct evidence.