Docs

Initialize a workspace

python3 tracker.py init ./acme-soc2 --company "Acme Inc"
# workspace initialized at ./acme-soc2 for Acme Inc (30 controls)
# (policies/ gets the 12 templates to customize)

Re-running init on an existing workspace refuses unless you pass --force — your evidence is never silently wiped.

Attach evidence and score

python3 tracker.py evidence ./acme-soc2 CC6.3-01 ./okta-mfa.png \
  --note "Okta MFA enforcement screenshot"
# evidence attached to CC6.3-01: okta-mfa.png

python3 tracker.py status ./acme-soc2   # checklist with ✓ / ·
python3 tracker.py score ./acme-soc2
# readiness: 1/30 (3.3%)

Report and handoff

python3 tracker.py report ./acme-soc2
# report written to ./acme-soc2/report.html

python3 tracker.py export-pack ./acme-soc2
# auditor handoff pack: ./acme-soc2/auditor_handoff.zip (29 open gaps disclosed)

The handoff zip contains the report, a machine-readable evidence index, every evidence file, and all policies — gaps disclosed honestly.

The 30 controls

Mapped to Trust Services Criteria: CC6 (logical & physical access), CC7 (system operations), CC8 (change management), A1 (availability) — plus CC1–CC5 foundations. Each control lists the exact artifact an auditor will ask for. See controls.py.