Twenty-Four Free Downloads, and None of Them Need an Account

Start Here

If you only take one thing, take the first. It tells you where you stand and the result is yours whether or not you ever engage anybody.

Security Readiness Assessment

FRM-RDY-001 · XLSX

Eighty questions across all six framework functions. Every control is asked twice: do you do this, and could you prove it today.

DownloadWhat is in it

Registers and Working Files

Spreadsheets you maintain rather than read. Each is what we would start from on an engagement, with the scales and the worked examples left in.

Evidence Register

FRM-EVR-001 · XLSX

Evidence items with the artifact, the source system, the population it must cover and how often to refresh it. The document that turns every future audit into a lookup.

Download

Risk Register

FRM-RSK-001 · XLSX

Auto-scoring matrix, likelihood and impact before and after treatment, adaptable scales and a worked example.

Download

Questionnaire Response Kit

FRM-QRK-001 · XLSX

The fifty questions customers ask most, what each is really testing, the evidence that answers it, and a model answer to adapt. With a gap summary.

Download

Insurance Renewal Preparation

FRM-INS-001 · XLSX

The controls insurers ask about, what each question tests, and the evidence to attach. Work through it a month before renewal.

Download

Supplier Security Assessment

FRM-SUP-001 · XLSX

Questions tiered by supplier risk, so a low-risk supplier answers a handful and a critical one answers all of them.

Download

Asset Inventory Register

FRM-AST-001 · XLSX

Devices, infrastructure and software, each with an owner, a criticality and its security state, plus a reconciliation that compares the inventory with every tool that counts devices. The denominator every other control is measured against.

Download

Microsoft 365 Security Baseline Checklist

FRM-M365-001 · XLSX

The tenant settings that matter most, each with where to check it, the export that proves it, the license it needs, and the way it looks done when it is not. Every row cites the CISA SCuBA baseline it comes from.

Download

Policies and Standards

Written to be cut down to your organization rather than adopted whole. Every threshold is a number somebody has to agree, and they are marked.

Information Security Policy

POL-ISMS-001 · DOCX

Covering access, devices, information handling, email fraud, suppliers, backup, reporting and exceptions.

Download

Acceptable Use Policy

POL-AUP-001 · DOCX

The rules, then guidance for the six situations staff actually face, then why each rule exists. With a one-page quick reference intended to be circulated separately.

Download

Backup and Recovery Policy

POL-BKP-001 · DOCX

Backup types and what each actually protects against, retention set against observed dwell time, restoration order by dependency, four levels of test, cloud and supplier data, plus a restore test record and a recovery runbook.

Download

Joiner, Mover and Leaver Standard

STD-JML-001 · DOCX

Role profiles, the three processes in operational detail, non-routine departures, and the quarterly reconciliation that produces the evidence an assessor asks for first.

Download

Vulnerability and Patch Management Program

PRG-VPM-001 · DOCX

Zone-based remediation periods stated in hours and days rather than deferred, the three windows of exposure and who controls each, an enforcement ladder with real consequences, and a glossary.

Download

Authentication Standard

STD-AUT-001 · DOCX

Authenticators ranked by what they resist, privileged and emergency access accounts, legacy protocols, service accounts and help desk resets, with a monthly reconciliation that proves a second factor is enforced on every account rather than registered.

Download

Regulator Self-Assessments

Every requirement in a regulator's cyber risk document as a row you can mark against, with the board's own oversight questions on a separate sheet. Each row cites the paragraph it comes from.

FSC Cyber Risk Self-Assessment

FRM-FSC-001 · XLSX

For insurers, pension entities and securities licensees under the Financial Services Commission guidance on managing cyber risk. Who each requirement falls on, the evidence that would show it is met, and the sixty board oversight questions.

Download

BOJ Cyber Risk Self-Assessment

FRM-BOJ-001 · XLSX

For deposit-taking institutions under the Bank of Jamaica standard on managing cyber risk. The same structure as the FSC workbook, against the Bank's own text, with a note on the standard's status.

Download

Privacy

The record of what personal data you hold and why, and the assessment that is built from it.

Record of Processing Activities

FRM-ROP-001 · XLSX

One row per processing activity with its purpose, lawful basis, data, recipients, transfers, retention and security, and the system export each entry was built from, so the record can be checked rather than believed.

Download

Data Protection Impact Assessment Template

TMP-DPI-001 · DOCX

Screening, the processing description, necessity and proportionality, a defined likelihood and severity scale, inherent and residual risk, and a sign-off in which every residual risk is accepted by somebody named. With a worked example.

Download

Plans and Guides

The documents that matter on the day something happens, and the ones that decide whether anybody above you understands it.

Incident Response Plan

PLN-IR-001 · DOCX

Severity definitions, roles, contact list, the six phases, an incident log and an after-action record.

Download

Incident Response Tabletop Exercise Pack

GDE-TTX-001 · DOCX

Preparation, a facilitator guide including what to listen for, five complete scenarios with timed injects, the closing sequence, reporting and follow-up, plus an invitation, observation sheet and findings log.

Download

Board Security Reporting

GDE-BRD-001 · DOCX

Why security reporting usually fails, the report structure section by section, the measures worth reporting and those worth avoiding, plus a template and a worked example.

Download

Ransomware Response Playbook

PRO-RAN-001 · DOCX

The first hour and what not to do in it, decisions authorized in advance, containment starting with identity, backup protection, notifications, the ransom decision, and recovery in dependency order. Runs under the Incident Response Plan.

Download

Business Email Compromise Response Playbook

PRO-BEC-001 · DOCX

Two first-hour tracks: a redirected payment, where hours decide whether the money comes back, and a taken-over mailbox. With the payment verification controls that stop it happening again.

Download

Phishing Reporting Route Test

PRO-PHR-001 · DOCX

Whether a reported email reaches somebody who acts on it, and how fast, rather than how many people clicked. Route mapping, a planted report test, a staff simulation and the measures that matter.

Download

Which Framework Applies to You

Usually the answer is whichever one your customer, insurer or regulator is asking about, which is a shorter conversation than choosing one on merit.

A crosswalk lets one assessment answer more than one question. Ours will cover ISO 27001 and SOC 2 against the NIST CSF spine. It is not built yet, and until it is, this table says so rather than implying otherwise.

Free Guides

Plain-language explainers, written for the person who has to answer a questionnaire rather than for a security team. These are in preparation, and this page will say so until each one exists.

In the meantime, the notes cover the same ground in shorter form, and the common questions answer what an engagement ends with and what we will not do.