Security Audit & Compliance Readiness Assessment

Welcome to the Security Audit & Compliance Readiness Assessment. This survey asks about your team's or function's audit preparedness over the past 12 months. Your participation is voluntary, and you may stop at any time. There are no right or wrong answers—we value your honest perspective. All responses will be kept confidential and reported only in aggregate to identify readiness gaps and prioritize pre-audit actions. The survey takes approximately 10 minutes to complete. If you are unsure about a question, select 'Not sure' or skip it.

Which of the following attestations or audits are expected to apply to your area in the next 12 months? Select all that apply.

• SOC 2
• ISO 27001
• ISO 27701
• PCI DSS
• HIPAA
• FedRAMP
• SOX ITGC
• GDPR
• CCPA/CPRA
• Other
• Not sure

Which primary control framework does your area currently align to?

• ISO 27001 Annex A
• NIST SP 800-53
• NIST CSF
• COBIT
• SOC Trust Services Criteria
• Custom/internal framework
• None
• Not sure

How confident are you that your team could retrieve all required audit evidence within 5 business days?

Approximately how many audit or compliance findings are currently open for your area?

• 0
• 1–5
• 6–10
• 11–20
• 21–50
• More than 50
• Not sure

We'd like to explore your team's audit readiness challenges in a bit more depth. An AI moderator will ask you 1–2 follow-up questions based on the topics covered in this survey.

What support or enablement would help your team most before the next audit?

Which function best describes your role?

• Engineering/Development
• IT/Operations
• Security/GRC
• Product/Program Management
• Data/Analytics
• Finance/Legal
• HR/People
• Other

Thank you for completing this assessment. Your responses will help us identify readiness gaps and prioritize actions before the next audit cycle. If you have any questions, please reach out to your compliance team.

How clearly is the audit scope defined for your team or function?

How would you rate the current implementation status of access management controls in your area?

• Fully implemented and tested
• Implemented but not regularly tested
• Partially implemented
• Planned but not yet implemented
• Not applicable
• Not sure

Where is most audit evidence or source records stored today? Select all that apply.

• Ticketing system (e.g., Jira, ServiceNow)
• GRC platform
• Shared drives (e.g., SharePoint, Google Drive)
• Version control (e.g., Git)
• SIEM/log platform
• HRIS
• Asset inventory/CMDB
• Email threads
• Other

Rank the following blockers to audit readiness from biggest (top) to smallest (bottom).

1. Insufficient staffing
2. Unclear requirements
3. Evidence scattered across tools
4. Competing priorities
5. Control gaps or coverage issues
6. Limited tooling or automation

Based on your responses in this survey, is there any additional context or feedback you would like to share about your team's audit readiness?

Approximately how many employees are in your organization?

• Fewer than 100
• 100–499
• 500–999
• 1,000–4,999
• 5,000–9,999
• 10,000 or more
• Not sure

Who is the primary owner of audit responses for your team or function?

• Team lead/manager
• Dedicated compliance/PM
• Technical SME
• Shared ownership (no single owner)
• No designated owner
• Not sure

How would you rate the current implementation status of change management controls in your area?

• Fully implemented and tested
• Implemented but not regularly tested
• Partially implemented
• Planned but not yet implemented
• Not applicable
• Not sure

On average, how long does it take your team to produce evidence once an auditor requests it?

• Same day
• 1–2 business days
• 3–5 business days
• 6–10 business days
• More than 10 business days
• Not sure

When is your next internal readiness review or dry run planned?

• Within the next month
• 1–3 months from now
• 3–6 months from now
• 6–12 months from now
• No review planned
• Not sure

Approximately how many people are in your team or function?

• 1–5
• 6–10
• 11–25
• 26–50
• 51–100
• Over 100
• Not sure

How would you rate the current implementation status of incident response controls in your area?

• Fully implemented and tested
• Implemented but not regularly tested
• Partially implemented
• Planned but not yet implemented
• Not applicable
• Not sure

Briefly describe the most significant audit risk currently facing your area.

Where are you primarily located?

• Americas
• EMEA
• APAC
• Other
• Prefer not to say

To what extent is control testing automated in your area?

When were your key policies and standards last reviewed and approved?

• Within 6 months
• 6–12 months ago
• 12–24 months ago
• Over 24 months ago
• Not applicable
• Not sure

Approximately what percentage of your team completed required security or compliance training in the last 12 months?

• 0% (none)
• 1–25%
• 26–50%
• 51–75%
• 76–99%
• 100% (all)
• Not sure