# Standards Checklist

## How To Complete

1. Fill metadata and ensure it matches the evidence run folder.
2. Use one status value per row: `Meets`, `Partially Meets`, `Does Not Meet`, `Not Evaluated`.
3. Add at least one concrete artifact path for each status decision.
4. In `Notes`, explain why the evidence is sufficient or insufficient.
5. Keep `Gap Summary` focused on what still blocks compliance confidence.

## Metadata

Date (UTC):
Environment URL:
Commit:
Run ID:

## OWASP ASVS (selected)

| Control | Requirement | Status | Evidence Path | Notes |
|---|---|---|---|---|
| V1 | Architecture/design documented |  |  |  |
| V2 | Authentication controls |  |  |  |
| V3 | Session management |  |  |  |
| V4 | Access control enforcement |  |  |  |
| V5 | Input validation and encoding |  |  |  |
| V7 | Error handling and logging |  |  |  |
| V8 | Data protection at rest/in transit |  |  |  |
| V10 | Malicious code / injection resistance |  |  |  |

## NIST SP 800-53 / 800-63-aligned checks (selected)

| Control Family | Requirement | Status | Evidence Path | Notes |
|---|---|---|---|---|
| AC | Least privilege / access enforcement |  |  |  |
| AU | Auditable events and retention |  |  |  |
| IA | Identity proofing and authentication federation |  |  |  |
| SC | Cryptographic protections and key handling |  |  |  |
| CM | Configuration and change management |  |  |  |
| CP | Resilience / single point of failure acknowledgement |  |  |  |

## Gap Summary

-