BUSINESS-RULE EVIDENCE CHECKLIST

Workflow and owner:
Promise, source and who agreed it:
Inputs, boundaries and failure conditions:
State that must change:
State that must remain unchanged:
Existing SOC 2 / pentest / test evidence relevant to this rule:
Missing scenarios and the check for each:
Requirement version, code revision and configuration:
Observed result and a link to the execution:
Untested conditions or conflicting expectations:
Decision needed, owner and next action:
What change would require these checks to run again:

Guide: https://reqproof.com/topics/soc2-pentest-business-logic