Compliance readiness workspace
Work through the steps toward GDPR accountability, a SOC 2 report and ISO/IEC 27001 certification. Progress and notes stay in this browser.
These checklists are a preparation aid. Metarial is not currently certified or audited under these standards, and completing a checklist does not make you compliant — SOC 2 reports come from an independent CPA firm, ISO 27001 certificates from an accredited certification body, and GDPR has no official certificate.
GDPR
EU regulation — supervised by national data protection authorities
No official certificate; you demonstrate accountability with records.
Record of processing activities
List what personal data you hold, why, where it is stored and who receives it.
Lawful basis per purpose
Document consent or another lawful basis for each advertising use of contact data.
Privacy notice published
Name the data, recipients (e.g. Meta) and purposes on your site.
Consent records & withdrawal
Store who agreed, when and to what; let people withdraw as easily as they agreed.
Data subject request process
Handle access, correction and deletion requests within one month.
Processor agreements
Sign data processing agreements with every vendor handling personal data.
Breach response plan
Know how to notify the authority within 72 hours where required.
Impact assessments
Run a DPIA for high-risk processing such as large-scale profiling.
SOC 2
AICPA framework — report issued by an independent CPA firm
A Type I or Type II attestation report after an external audit.
Define scope & trust criteria
Choose systems in scope and criteria (Security is required).
Written security policies
Information security, acceptable use, access control, change management.
Access control & MFA
Least-privilege access, MFA, quarterly access reviews.
Change management
Code review and approval before production changes.
Logging & monitoring
Collect and review security logs and alerts.
Vendor risk management
Review the security reports of key vendors.
Incident response
Documented and tested incident response procedure.
Engage a CPA firm
Select an auditor and observation window (Type II usually 3–12 months).
ISO/IEC 27001
ISO standard — certified by an accredited certification body
A certificate after Stage 1 and Stage 2 audits, with yearly surveillance.
ISMS scope & context
Define the information security management system boundaries.
Risk assessment & treatment
Identify risks and decide how each is treated.
Statement of Applicability
Justify which Annex A controls apply.
Leadership & roles
Management commitment, security policy and assigned responsibilities.
Awareness & training
Staff security training with records.
Internal audit
Audit the ISMS before the certification audit.
Management review
Leadership reviews ISMS performance and decisions.
Book certification body
Choose an accredited body for Stage 1 and Stage 2 audits.