Preparing for a Compliance Audit: A 30-Day Checklist

A review deadline has a way of showing how little we know about where our sensitive data lives. Whether it is a PCI questionnaire, a client's security questionnaire, an insurer's review, or your own Safeguards Rule risk assessment, the same question comes up: where is the regulated data, and what are you doing about it? Here is a four-week plan for a small office, built around producing evidence rather than assurances.

This is general education, not legal advice. What a particular review requires depends on the rule and the reviewer, so confirm the scope with your attorney, advisor or the party asking. A tool and a checklist support your preparation; they cannot promise any particular outcome.

Week 1: Discover

The goal is a map. List every computer, synced cloud folder and external disk that could hold sensitive data. Add the computers, run a full scan, and let the first results come in. MyVaultMate finds Social Security numbers and ITINs, payment card numbers, labeled driver's license, passport and date-of-birth values, medical record numbers, Medicare numbers and health insurance member IDs, and a keyword signal for health information. Remember what it does not read yet: RTF and PowerPoint files, Outlook .pst data files, and zip archives, plus pictures, videos, recordings and scanned PDFs. Each is listed as “Not scanned”, and the dashboard's Not scanned list shows them all. Add a manual check of those.

By Friday you should have: a computer list, the first exposure report, and a note of any places you could not scan.

Week 2: Prioritize and fix

Work the findings from Critical downward. For each, decide whether the file is needed. Delete what is not, move what is into access-controlled, encrypted storage, and note who had access. The product finds and ranks; your team or IT provider does the moving, encrypting and deleting. Give each fix an owner and a date. Expect a few false alarms in the list; mark them and move on.

Week 3: Document

Reviewers want to see written, dated material. Gather:

• your risk assessment or risk analysis, updated with what the scan showed;
• the remediation log: what was found, what you decided, what was done and when;
• your retention rule for each major document type;
• who has access to what, and the people responsible for security;
• the exports from the dashboard, as PDF, CSV or XLSX, including the branded exposure report with files scanned, files with exposed data, high-severity findings, devices affected and an estimate of the ID numbers found.

If the Safeguards Rule applies to you, check that you have a written information security program, a designated qualified individual and an incident response plan, and that multi-factor authentication and encryption are addressed. A scan does not create those documents; it feeds the risk assessment.

Week 4: Verify and set a rhythm

Re-scan. Confirm that the Critical findings you fixed are gone, and compare the new report with the first one you saved to show the trend. Handle stragglers. Then choose a schedule you will keep, whether hourly, daily or weekly, and put a monthly dashboard review on the calendar. After the review, the point is not to relax; new copies appear every week.

A one-page evidence folder

1. Computer and location inventory.
2. First and latest exposure reports.
3. Remediation log.
4. Retention rules.
5. Security program and incident response plan.
6. Scan schedule and who reviews it.

Be honest in the room

Do not claim more than you have. If something is unfinished, say what is done, what is next and when. A dated plan with visible progress is more credible than a promise that everything is perfect. For specifics, bring in your attorney or compliance advisor early, not in week four.

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).