> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organization: Acme Inc

Assessment Date: 2026-03-19

Assessor: [NAME / TITLE]

This self-assessment questionnaire evaluates compliance program maturity across six domains. Each question is scored on a 1–5 scale. Questions marked `[AUTO]` have been pre-filled based on automated code analysis. Review and adjust all scores before finalizing.

## Scoring Guide

Score | Level | Description
--- | --- | ---
1 | Initial | Ad-hoc, no formal process
2 | Developing | Basic processes exist but inconsistently applied
3 | Defined | Documented processes, consistently followed
4 | Managed | Measured, monitored, and continuously improved
5 | Optimized | Industry-leading, fully automated and integrated

## Maturity Summary

Domain | Auto-Score | Questions Assessed | Maturity Level
--- | --- | --- | ---
Governance & Leadership | 2.8/5.0 [███░░] | 4/9 | Defined (Level 3)
Privacy & Data Protection | 3.2/5.0 [███░░] | 6/9 | Defined (Level 3)
Information Security | 3.0/5.0 [███░░] | 4/9 | Defined (Level 3)
Vendor & Third-Party Risk | 3.0/5.0 [███░░] | 3/8 | Defined (Level 3)
AI Governance & Ethics | 3.0/5.0 [███░░] | 3/8 | Defined (Level 3)
Incident Response & Business Continuity | 3.0/5.0 [███░░] | 3/7 | Defined (Level 3)

Overall Maturity Score: 3.0/5.0 — Defined (Level 3)

Questions Auto-Assessed: 23/50 (46%)

Questions Requiring Manual Assessment: 27

Maximum Possible Score: 250 (50 questions × 5 points)

## Governance & Leadership

> Organizational commitment to compliance, executive sponsorship, and program management.

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
GOV-01 | Is there a formal compliance program with executive sponsorship? | [AUTO] 3 | [AUTO] Compliance documentation generated via automated scanning
GOV-02 | Are compliance policies documented, approved, and distributed to all staff? | [AUTO] 3 | [AUTO] Automated compliance scanning provides baseline policy framework
GOV-03 | Is there a dedicated compliance officer or team? | [ ] _ | [MANUAL] |
GOV-04 | Is the scope of compliance obligations clearly defined? | [AUTO] 3 | [AUTO] 8 services detected — compliance scope is well-defined
GOV-05 | Are compliance roles and responsibilities assigned across the organization? | [ ] _ | [MANUAL] |
GOV-06 | Is compliance training provided to all employees at least annually? | [ ] _ | [MANUAL] |
GOV-07 | Are compliance policies reviewed and updated at least annually? | [AUTO] 2 | [AUTO] Automated compliance document generation provides baseline documentation
GOV-08 | Is there a compliance committee or steering group that meets regularly? | [ ] _ | [MANUAL] |
GOV-09 | Are compliance metrics reported to the board or senior leadership? | [ ] _ | [MANUAL] |

## Privacy & Data Protection

> Data privacy program maturity, GDPR/CCPA readiness, and data subject rights handling.

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
PRI-01 | Is there a comprehensive, up-to-date privacy policy? | [AUTO] 4 | [AUTO] Privacy policy auto-generated from code analysis
PRI-02 | Is there a complete data inventory/flow map of all personal data processing? | [AUTO] 3 | [AUTO] Data flow map generated from detected services
PRI-03 | Is there a documented process for handling data subject access requests (DSARs)? | [AUTO] 3 | [AUTO] DSAR handling guide generated
PRI-04 | Is consent obtained and recorded for all data processing requiring it? | [AUTO] 3 | [AUTO] Consent management guide generated for detected analytics services
PRI-05 | Are data protection impact assessments (DPIAs) conducted for high-risk processing? | [ ] _ | [MANUAL] |
PRI-06 | Is there a documented data retention policy with defined retention periods? | [AUTO] 3 | [AUTO] Data retention policy auto-generated
PRI-07 | Is there a lawful basis assessment for each data processing activity? | [ ] _ | [MANUAL] |
PRI-08 | Is a Record of Processing Activities (ROPA) maintained and current? | [AUTO] 3 | [AUTO] Record of processing activities generated (GDPR Art. 30)
PRI-09 | Are cross-border data transfers assessed and safeguarded (e.g., SCCs, adequacy decisions)? | [ ] _ | [MANUAL] |

## Information Security

> Technical and organizational security controls, vulnerability management, and access control.

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
SEC-01 | Is authentication required for all system access, with MFA for privileged accounts? | [AUTO] 4 | [AUTO] Authentication service detected: @supabase/supabase-js
SEC-02 | Is there continuous security monitoring and alerting in place? | [AUTO] 3 | [AUTO] Monitoring detected: @sentry/node
SEC-03 | Is there a documented access control policy with role-based access? | [ ] _ | [MANUAL] |
SEC-04 | Are regular vulnerability scans and penetration tests conducted? | [AUTO] 3 | [AUTO] Vulnerability scanning included in compliance toolchain
SEC-05 | Is there a secure software development lifecycle (SDLC) with code review? | [ ] _ | [MANUAL] |
SEC-06 | Is data encrypted at rest and in transit? | [AUTO] 2 | [AUTO] Database service detected (prisma) — encryption at rest needs manual verification
SEC-07 | Are security patches applied within defined SLAs? | [ ] _ | [MANUAL] |
SEC-08 | Is there network segmentation between production and development environments? | [ ] _ | [MANUAL] |
SEC-09 | Are audit logs maintained, protected from tampering, and reviewed regularly? | [ ] _ | [MANUAL] |

## Vendor & Third-Party Risk

> Third-party risk management, vendor due diligence, and sub-processor oversight.

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
VEN-01 | Is there a complete inventory of all third-party services and sub-processors? | [AUTO] 3 | [AUTO] 8 third-party services detected and inventoried
VEN-02 | Are Data Processing Agreements (DPAs) in place with all sub-processors? | [AUTO] 3 | [AUTO] Sub-processor list auto-generated from code analysis
VEN-03 | Is vendor due diligence performed before onboarding new services? | [ ] _ | [MANUAL] |
VEN-04 | Are third-party risk assessments conducted and documented? | [AUTO] 3 | [AUTO] Third-party risk assessment generated
VEN-05 | Is there a vendor exit strategy for critical third-party dependencies? | [ ] _ | [MANUAL] |
VEN-06 | Are sub-processor changes communicated to affected data subjects? | [ ] _ | [MANUAL] |
VEN-07 | Are vendor SLAs monitored and reviewed at least annually? | [ ] _ | [MANUAL] |
VEN-08 | Is there a process for revoking vendor access upon contract termination? | [ ] _ | [MANUAL] |

## AI Governance & Ethics

> AI risk management, transparency, fairness, and compliance with AI regulations (EU AI Act, etc.).

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
AI-01 | Is there an inventory of all AI/ML systems with risk classifications? | [AUTO] 3 | [AUTO] AI services detected: openai
AI-02 | Is AI usage disclosed to end users with clear explanations? | [AUTO] 3 | [AUTO] AI disclosure document generated
AI-03 | Are AI outputs monitored for bias, accuracy, and safety? | [ ] _ | [MANUAL] |
AI-04 | Is there a process for users to opt out of AI-driven decisions? | [ ] _ | [MANUAL] |
AI-05 | Is there an AI governance framework aligned with regulations (EU AI Act, NIST AI RMF)? | [AUTO] 3 | [AUTO] AI governance framework generated
AI-06 | Are AI model cards or system documentation maintained? | [ ] _ | [MANUAL] |
AI-07 | Is human oversight provided for high-risk AI decisions? | [ ] _ | [MANUAL] |
AI-08 | Are AI training data sources documented and assessed for legality? | [ ] _ | [MANUAL] |

## Incident Response & Business Continuity

> Incident detection, response, communication, and recovery capabilities.

# | Question | Score (1-5) | Justification
--- | --- | --- | ---
INC-01 | Is there a documented and tested incident response plan? | [AUTO] 3 | [AUTO] Incident response plan auto-generated
INC-02 | Are breach notification templates prepared per applicable jurisdiction? | [AUTO] 3 | [AUTO] Data breach notification templates generated per jurisdiction
INC-03 | Is there a dedicated incident response team with clear escalation paths? | [ ] _ | [MANUAL] |
INC-04 | Is there an incident severity classification system? | [AUTO] 3 | [AUTO] Incident severity matrix generated (P0-P4)
INC-05 | Are post-incident reviews conducted with lessons learned? | [ ] _ | [MANUAL] |
INC-06 | Is there a business continuity plan with defined RTO/RPO? | [ ] _ | [MANUAL] |
INC-07 | Are disaster recovery procedures tested at least annually? | [ ] _ | [MANUAL] |

## Improvement Action Plan

Based on the assessment results, prioritize the following areas:

Priority | Domain | Current | Target | Action Required | Owner | Deadline
--- | --- | --- | --- | --- | --- | ---
1 | Governance & Leadership | 2.8 | 3.8 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]
2 | Information Security | 3.0 | 4.0 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]
3 | Vendor & Third-Party Risk | 3.0 | 4.0 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]
4 | AI Governance & Ethics | 3.0 | 4.0 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]
5 | Incident Response & Business Continuity | 3.0 | 4.0 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]
6 | Privacy & Data Protection | 3.2 | 4.2 | [DESCRIBE ACTIONS] | [OWNER] | [DATE]

## Assessment Sign-Off

Role | Name | Signature | Date
--- | --- | --- | ---
Assessor | [NAME] | _ | [DATE]
Compliance Officer | [NAME] | _ | [DATE]
Executive Sponsor | [NAME] | _ | [DATE]

## Next Assessment

Recommended next assessment date: 2026-06-17 (quarterly cadence).

This compliance maturity assessment was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase. Auto-scored questions should be verified by your compliance team. This assessment does not constitute legal advice or formal certification.