Self-scoring workbooks that give you a number rather than a feeling, and complete production-ready documents built to the same standard we deliver to paying clients.
Fourteen free resources
Self-scoring workbooks and complete production-ready documents, built to the same standard we deliver to paying clients. Yours to keep, adapt and use, with or without us.
Self-scoring workbooks that give you a number rather than a feeling.
Eighty questions across all six framework functions. Every control is asked twice: do you do this, and could you prove it today.
DownloadTwenty-five evidence items with the artefact, the source system, the population it must cover and how often to refresh it. The document that turns every future audit into a lookup.
DownloadAuto-scoring matrix, likelihood and impact before and after treatment, adaptable scales and a worked example.
DownloadFor the three triggers we see most: a customer questionnaire, an insurance renewal, and a supplier you need to check.
The fifty questions customers ask most, what each is really testing, the evidence that answers it, and a model answer to adapt. With a gap summary.
DownloadTwenty-five controls insurers ask about, what each question tests, and the evidence to attach. Work through it a month before renewal.
DownloadTwenty-eight questions tiered by supplier risk, so a low-risk supplier answers eight and a critical one answers all of them.
DownloadComplete, editable documents with bracketed fields to replace. Not samples.
Fifteen sections covering access, devices, information handling, email fraud, suppliers, backup, reporting and exceptions.
DownloadTwelve pages. The rules, then guidance for the six situations staff actually face, then why each rule exists. With a one-page quick reference intended to be circulated separately.
DownloadSeventeen pages. Backup types and what each actually protects against, retention set against observed dwell time, restoration order by dependency, four levels of test, cloud and supplier data, plus a restore test record and a recovery runbook.
DownloadEight pages. Severity definitions, roles, contact list, the six phases, an incident log and an after-action record.
DownloadFourteen pages. Role profiles, the three processes in operational detail, non-routine departures, and the quarterly reconciliation that produces the evidence an assessor asks for first.
DownloadEleven pages. Why security reporting usually fails, the report structure section by section, the measures worth reporting and those worth avoiding, plus a template and a worked example.
DownloadFourteen pages with six diagrams. Zone-based remediation periods stated in hours and days rather than deferred, the three windows of exposure and who controls each, an enforcement ladder with real consequences, and a glossary.
DownloadRun it yourself. No facilitator training required.
Thirteen pages. Preparation, a facilitator guide including what to listen for, five complete scenarios with timed injects, the closing sequence, reporting and follow-up, plus an invitation, observation sheet and findings log.
DownloadThese tools are self-reported and unverified, and we say so on the front of them. They record what you believe about your controls. Establishing what is true is the paid work, and if our honest view after the free review is that you do not need a paid engagement yet, we will say so.