4.2.1 [Organization Name] must maintain an approved secure configuration baseline for each type of system in scope, including at least workstations and laptops, servers, network and security devices, mobile devices, and each cloud service that holds information classified above Public.
4.6 Monitoring and deviations
4.6.2 A difference between a system and its baseline that was not approved is a deviation. The system owner must investigate it within [Deviation Investigation Period], then either restore the system to its baseline or approve the difference as a change or an exception.
Excerpt from the template. You complete the bracketed fields for your organization, or we complete them with the customization option.
Talk to a professional
Expert consultation, 30 or 60 minutes.
Bring a specific security, risk, compliance, or CMMC question and work through it with an experienced practitioner. Every session ends with a short written action summary.
30 minutes$225One focused question, a quick check on a decision, or a second opinion.
60 minutes$395Up to three related questions, with preparation from a short intake.
Remote video session. Confirm a time before you pay.
Catalog
Choose what you need.
Prices shown are proposed and in US dollars. Switch any document between template and customized to see both prices.
Expert sessionFrom $225
Expert Consultation
Talk through a specific security, risk, compliance, or CMMC question with an experienced practitioner.
30 minutes for $225: one focused question or a second opinion
60 minutes for $395: up to three related questions, with preparation
A concise written action summary after every session
Remote session, 30 or 60 minutes
Session scope and scheduling
The 30-minute session covers one focused question. The 60-minute session covers up to three related questions and includes up to 15 minutes of preparation. Both include a concise action summary within two business days. Detailed document review, implementation, emergency incident response, and certification decisions require separate scope.
Request available times and confirm a slot before paying. Rescheduling and cancellation follow our Refund Policy.
Establish security governance, accountability, and organization-wide expectations.
Governance roles and program oversight
Risk, policy review, and exception requirements
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set expectations for approved configurations, changes, baselines, and exceptions.
Purpose, scope, ownership, and policy requirements
Baseline, change, and exception management provisions
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
4.2.1 [Organization Name] must maintain an approved secure configuration baseline for each type of system in scope, including at least workstations and laptops, servers, network and security devices, mobile devices, and each cloud service that holds information classified above Public.
4.6 Monitoring and deviations
4.6.2 A difference between a system and its baseline that was not approved is a deviation. The system owner must investigate it within [Deviation Investigation Period], then either restore the system to its baseline or approve the difference as a change or an exception.
Excerpt from the template. You complete the bracketed fields for your organization, or we complete them with the customization option.
Define how access is requested, approved, reviewed, and removed.
Account and access responsibilities
Privileged, remote, and third-party access expectations
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Establish incident reporting, response responsibilities, and oversight.
Reporting, escalation, and response requirements
Exercise, review, and lessons-learned provisions
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set clear rules for using company systems, accounts, and information. Free, so you can see the quality of the library before you buy.
Permitted and prohibited use
User responsibilities and reporting expectations
Completion guide and document control fields
Editable Word document
Free sample. The full editable policy with its completion guide.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define how information assets are inventoried, owned, and managed.
Asset ownership and inventory expectations
Lifecycle, return, and disposal requirements
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Assign information categories and define how each should be handled.
Classification ownership and labeling expectations
Handling, sharing, storage, and disposal requirements
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define how security risks are assessed, treated, and accepted.
Risk ownership and decision authority
Assessment, treatment, acceptance, and review requirements
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Establish security expectations across the vendor lifecycle.
Vendor tiering and due diligence expectations
Contract, monitoring, and exit requirements
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set responsibilities for identifying and addressing security weaknesses.
Assessment and remediation expectations
Risk-based prioritization, exceptions, and reporting
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Require controlled evaluation and authorization of system changes.
Change roles, approvals, and records
Testing, emergency changes, and post-change review
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define expectations for generating, protecting, and reviewing security logs.
Log ownership, coverage, and protection
Review, alert handling, retention, and oversight
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Establish requirements for protecting and recovering information and systems.
Backup ownership and recovery objectives
Protection, restoration testing, and review
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set security training expectations for staff and designated roles.
Audience, onboarding, and role-based responsibilities
Training records, refreshers, and effectiveness review
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define security responsibilities for working away from company facilities.
Approved devices and remote access
Workspace, information handling, and incident reporting
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set requirements for safeguarding facilities, equipment, and restricted areas.
Visitor, personnel, and area access expectations
Equipment protection and physical incident reporting
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define accountable retention and secure disposal of business information.
Retention ownership and approved schedules
Disposal, legal hold coordination, and records
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Establish oversight for maintaining critical business activities through disruption.
Continuity roles and critical process ownership
Plan maintenance, exercises, and recovery coordination
Completion guide and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define baseline security requirements for systems and applications.
Baseline selection, documentation, and approval criteria
Default settings, prohibited configurations, and deviations
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define practical requirements for authentication and credential protection.
Authentication methods and account protections
Credential storage, reset, and exception requirements
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set criteria for protecting information using encryption.
Approved use cases and algorithm selection process
Key ownership, lifecycle, protection, and recovery
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Specify the technical and operational requirements for security logs.
Event selection, timestamps, and source identification
Log protection, collection checks, and retention configuration
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Preview a sample page
DAYTOL · TEMPLATE EXCERPT
Security Logging Standard
4. Organization decisions
D-01 Log retention. Proposed value: 12 months, with the most recent 3 months quickly searchable. Basis: Daytol recommendation, confirmed or changed by your organization.
5. Requirements
S-01 Systems must log successful and failed sign-ins; account creation, change and deletion; privilege changes; changes to security settings and logging; security tool alerts; and administrator actions.
S-07 Each required source must be checked monthly to confirm it is still sending logs.
Excerpt from the template. You complete the bracketed fields for your organization, or we complete them with the customization option.
Define risk-based targets and validation requirements for remediation.
Severity, exposure, and business impact criteria
Organization-selected response targets and exception requirements
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define minimum protections for organization-managed endpoints.
Device enrollment, protection, and hardening requirements
Updates, encryption, local access, and monitoring
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Set requirements for managing network access and boundaries.
Segmentation, permitted connections, and administrative access
Rule reviews, configuration protection, and monitoring
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Define requirements for approved access from outside trusted environments.
Authentication, device, and connection requirements
Session controls, monitoring, and vendor access
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Translate information categories into practical handling requirements.
Storage, transmission, and sharing criteria
Labeling, printing, removable media, and disposal
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Specify requirements for recoverable and protected backups.
Frequency and retention fields tied to business needs
Isolation, encryption, access control, and restoration validation
Decision table with proposed values and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Run a repeatable review of user access and privileged permissions.
Review preparation, decisions, and evidence steps
Reviewer instructions and exception handling
Access review and removal tracker
Word procedure + Excel tracker
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Preview a sample page
DAYTOL · TEMPLATE EXCERPT
User Access Review Procedure
The review coordinator exports accounts and permissions from each system in scope and saves the dated exports to [Approved Repository].
The review coordinator compares the exports with the HR and vendor lists, flagging accounts of people who have left, accounts with no matching person, shared accounts and privileged accounts.
Each item is assigned to a reviewer who is not the account holder and not the person who granted the access.
Each reviewer marks every item Keep or Remove, with a reason for every privileged Keep.
Access administrators remove every item marked Remove within [Review Removal Period], and the coordinator confirms removals from a fresh export.
Excerpt from the template. You complete the bracketed fields for your organization, or we complete them with the customization option.
Manage access from the initial request through transfer or departure.
Request, approval, provisioning, and verification steps
Role changes, termination, and evidence capture
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Run a documented change from request through closure.
Impact assessment, testing, approval, and implementation
Rollback, emergency changes, and closure records
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Create, approve, maintain, and review system configuration baselines.
Baseline development and implementation steps
Deviation review, change tracking, and baseline validation
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Move identified weaknesses through triage, remediation, and verification.
Intake, validation, prioritization, and assignment
Testing, deployment, exception handling, and closure
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Assess reported events and escalate potential security incidents.
Intake, severity assessment, and escalation steps
Evidence preservation, handoff, and decision records
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Perform and document a consistent review of security logging.
Coverage checks, review steps, and investigation triggers
Escalation, review evidence, and follow-up tracking
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Conduct a repeatable assessment of a defined environment or business process.
Scope, information gathering, and risk identification
Analysis, treatment decisions, reporting, and review
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Review a vendor’s security before approval and during reassessment.
Intake, tiering, questionnaire, and evidence review
Findings, approvals, remediation, and reassessment records
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Plan, execute, and document a controlled restoration test.
Test scope, preparation, authorization, and execution
Validation, issue tracking, and test results
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Handle requests to deviate from approved security requirements.
Request, risk analysis, and compensating measures
Approval authority, expiry, review, and closure
Step-by-step workflow, failure handling, records, and document control fields
Editable Word document
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Record risks, assign owners, and track decisions through treatment.
Defined likelihood and impact scales
Risk, treatment, owner, and review fields
Instructions and a fictional worked example
Editable Excel workbook
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Collect consistent information and document a vendor security review.
Security due diligence questionnaire
Evidence and follow-up tracker
Reviewer guidance and assessment summary
Editable Excel questionnaires + Word review checklists
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and one defined document or workflow.
Short intake and one 30-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 7 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Understand the key security risks in one clearly defined environment.
Intake and scope confirmation for one environment
Up to four stakeholder interviews and review of up to ten agreed documents
Risk register, prioritized recommendations, and a findings discussion
Consultant-delivered assessment
Scope and delivery
Proposed fixed scope: one organization, one business unit or environment, one site, up to ten systems or services, four interviews of up to 60 minutes each, and ten agreed documents. Assessment criteria are confirmed in the written scope before payment.
Interview and document-based review; includes a risk register, prioritized findings, and one findings discussion. Target delivery: 15 business days after complete intake and interview availability. Scanning, penetration testing, implementation, certification, and assurance opinions are excluded.
A defined review of security risk across the agreed operations of an organization with up to 100 people.
Assessment across your systems, data, vendors, and key processes
Up to eight interviews and 30 agreed documents
Findings report, risk register, roadmap, and an executive readout
Consultant-delivered assessment
Scope and delivery
Proposed fixed scope: one organization with up to 100 people, two sites, 25 systems or services, six critical vendors, eight interviews of up to 60 minutes each, and 30 agreed documents. One set of assessment criteria and the boundary are confirmed before payment.
Interview and document-based review with a findings report, risk register, prioritized roadmap, and one executive readout. Target delivery: 20 business days after complete intake and interview availability. Vendor testing, scanning, penetration testing, implementation, certification, and assurance opinions are excluded. Larger scopes receive a separate proposal.
For larger or multi-site organizations that need a board-ready view of risk.
Scope set after a short call to match your organization
Expanded interviews, vendor review, and multiple sites or business units
Board-ready report, risk register, roadmap, and leadership readout
Consultant-delivered assessment
How scope is agreed
The starting price is not a fixed quote. A written proposal confirms legal entities, sites, systems, vendors, criteria, evidence volume, interviews, deliverables, schedule, exclusions, and client responsibilities before payment. Testing and implementation are included only if expressly scoped.
Compare a defined security program with an agreed framework or customer requirement and prioritize the gaps.
Confirm one framework or requirements set and the assessment boundary before payment
Review agreed documents and interview the relevant control owners
Receive a gap register, evidence observations, prioritized recommendations and a findings discussion
Consultant-delivered gap analysis
Scope and delivery
Quoted after a fit check. The written scope confirms the framework and version, legal entity, sites, systems, control coverage, interviews, evidence volume, deliverables and delivery schedule. Gaps are assessed against the agreed criteria; risk scoring and a formal certification assessment are separate activities.
Document and interview review only unless separately agreed. Scanning, penetration testing, remediation implementation, legal advice, certification decisions and assurance opinions are excluded.
A completion guide for each policy, plus the Tailoring Guide and Library Register
Editable Word documents
Save $374 compared with buying the 17 paid policies
View all 18 included policies
Information Security Policy
Configuration Management Policy
Access Control Policy
Incident Response Policy
Acceptable Use Policy
Asset Management Policy
Information Classification and Handling Policy
Risk Management Policy
Third-Party Risk Management Policy
Vulnerability Management Policy
Change Management Policy
Logging and Monitoring Policy
Backup and Recovery Policy
Security Awareness and Training Policy
Remote Work Policy
Physical Security Policy
Data Retention and Disposal Policy
Business Continuity Policy
Includes these 18 standalone policies with their completion guides, plus the Tailoring Guide and Library Register. Other standards, procedures, workbooks, and services are excluded.
View packageFull-set customization is quoted separately
Bundle$1,699
Complete Document Library
All 39 standalone policies, standards, and procedures listed in this catalog.
18 policies, 10 standards, and 11 procedures
Consistent structure and document control fields
Completion guides for every policy, plus the Tailoring Guide and Library Register
Editable Word documents and Excel trackers
Save $1,143 compared with buying each paid document
View the 39-document manifest
18 policies
Information Security Policy
Configuration Management Policy
Access Control Policy
Incident Response Policy
Acceptable Use Policy
Asset Management Policy
Information Classification and Handling Policy
Risk Management Policy
Third-Party Risk Management Policy
Vulnerability Management Policy
Change Management Policy
Logging and Monitoring Policy
Backup and Recovery Policy
Security Awareness and Training Policy
Remote Work Policy
Physical Security Policy
Data Retention and Disposal Policy
Business Continuity Policy
10 standards
Secure Configuration Standard
Password and Authentication Standard
Encryption and Key Management Standard
Security Logging Standard
Vulnerability Remediation Standard
Endpoint Security Standard
Network Security Standard
Remote Access Standard
Information Handling Standard
Backup and Restoration Standard
11 procedures
User Access Review Procedure
Account Provisioning and Termination Procedure
Change Control Procedure
Configuration Baseline Management Procedure
Patch and Vulnerability Remediation Procedure
Incident Triage and Escalation Procedure
Security Log Review Procedure
Security Risk Assessment Procedure
Vendor Due Diligence Procedure
Backup Restoration Testing Procedure
Security Exception Management Procedure
Includes the tracker packaged with the User Access Review Procedure. Separately sold workbooks, bundle-exclusive additions, assessments, sessions, and customization are excluded.
View packageFull-set customization is quoted separately
Bundle$299
Access Management Bundle
Put access policies, account workflows, and review records together.
Access Control Policy and bundle-exclusive Privileged Access Standard
Account Provisioning and Termination Procedure and User Access Review Procedure
Access review tracker, plus the bundle-exclusive access request/approval form and completion guide
Editable Word + Excel files
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and the listed bundle contents.
Short intake and one 60-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 15 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Template only. Editable files and instructions; your team completes the tailoring.
Customization scope and delivery
The selected total includes the template and tailoring for one organization and the listed bundle contents.
Short intake and one 60-minute working session.
Organization-specific roles, scope, terminology, and agreed requirements.
One draft, one consolidated revision round, and final editable files.
Target delivery: 15 business days after complete intake and the working session. Additional environments, new documents, technical implementation, testing, and certification are excluded. Expanded work is scoped before payment.
Tell us what you need and we will write it for your organization. We confirm the scope and price by email before you pay, so there are no surprises.
Policy$795
Standard$895
Procedure$995
Form or workbookQuoted
Send the request. Name the document and what it needs to cover.
We confirm scope and price by email, with a target response of one business day.
Pay, then a short intake and working session. Draft, one revision, and the final version in about 10 business days.
How buying works
Four ways to buy.
Template only
Buy the editable file, download it, and tailor it yourself. Each document includes completion instructions. The Acceptable Use Policy is free to download as a sample.
Editable Word or Excel files
Each policy includes its completion guide; bundles and full sets add the Tailoring Guide and Library Register
Download right after payment
Customized for your organization
We tailor the template to your organization. The customized price includes the template.
Short intake and one 30-minute session for a document, or one 60-minute kickoff for a bundle
Draft, one consolidated revision, and final editable files
Target: 7 business days for one document, or 15 for a bundle, after complete intake and the working session
Assessments and expert sessions
Consultant-delivered work with a defined scope.
Focused and Standard assessments start with a short fit check before payment; Comprehensive is quoted after a call
Expert sessions: confirm an available appointment before payment
Expert session action summary within two business days; assessment delivery is defined in each listing
Made to order
A document we do not list, written for your organization.
Request it with the form above
We confirm scope and price before payment
About 10 business days after the working session
Good to know. Templates are licensed for use within one organization and may not be resold. Documents need review, approval, and implementation by your organization, and framework mappings are included only where a listing says so. Templates and advisory products support your program; they do not certify it or guarantee compliance. Customization includes the selected template and document tailoring for one organization and the stated scope, with one consolidated revision. Implementation and testing are excluded. Work beyond the stated scope is quoted separately before payment.
Not sure what you need?
Tell us what is driving the need. We will point you to the right document, bundle, or service.
