I turned my IT governance checklist into a live tool. Not sure anyone wants that yet.

A while back I wrote up a checklist for non-technical founders, the boring stuff, password managers, 2FA, backups, who owns the vendor list nobody remembers signing up for. 20+ years of IT governance work, compressed into something you could actually finish in an afternoon.

It sold okay as a PDF. But a PDF you check once and forget isn't actually the job. The job is remembering to come back to it when something changes first user, first paying customer, first hire.

So I built a small version of it as a live scorecard instead. Same 38 items, same reasoning behind each one, but it tracks what you've actually checked and highlights what matters most at your current stage instead of dumping all 38 on you at once.

I'm intentionally not calling this a "GRC platform." That word belongs to tools built for companies chasing SOC 2 audits with a compliance team behind them. This is for the stage before that one person, no budget, just trying not to get blindsided by something a checklist would've caught.

Honestly not sure if this is a real want or just a nice-to-have wrapped around content I'd already written. Before I build it out further (saved notes, a vendor tracker, whatever), I'd rather find out.

Here it is: https://grcarc.netlify.app/
It's deliberately unstyled beyond the basics. I care more right now about whether this is useful than whether it's pretty.
If you're a solo founder or a two-person team: would you actually use something like this, or is a static checklist genuinely enough? What would make you come back to it a second time?