IT policy templates and compliance checklists

76 controls mapped to 45 CFR, with the evidence auditors ask for. PDF and Excel.

The Trust Services Criteria as a working checklist for IT teams. PDF and Excel.

All 20 control families with the Low, Moderate and High baselines. Excel and PDF.

The 110 requirements and how they feed your SPRS score.

A practical starting point for NIST CSF and 800-53 work. PDF and Excel.

Implementation steps and Annex A controls to track toward certification.

Privacy controls that extend ISO 27001 into a privacy management system.

Ten areas to cover when your team handles EU personal data.

What a small defense supplier needs in place for CMMC.

Key NIS2 requirements for essential and important entities.

The steps toward HITRUST certification, in order.

Safeguards for customer financial data under GLBA.

Requirements for CSA STAR Levels 1, 2 and 3.

Prepare for a TISAX assessment in the automotive supply chain.

ECC-2:2024 domains and the evidence auditors look for.

Domain-by-domain requirements for Saudi financial institutions.

IT controls for J-SOX internal control reporting.

Common Criteria evaluation steps for IT products.

Apply CIS Benchmarks to your devices, step by step.

A blank structure for any framework your team works to.

Seven areas every internal IT audit should cover.

Check enrollment, policies and compliance across your managed devices.

Seven steps to lock down a server before it goes live.

The top-level policy that sets your security rules and owners.

Rules for devices, accounts, networks and incidents in one document.

How your network is segmented, monitored and protected.

Who changes firewall rules, how, and how they are reviewed.

Rules for cloud accounts, data and shared responsibility.

Which endpoints need protection and how it is kept current.

Patch timelines by severity, testing and exceptions.

Governance rules for company and personal phones and laptops.

What employees can do with personal devices at work.

Security rules for the mobile apps your company builds or allows.

Rules for corporate and guest wireless networks.

When remote staff must use the VPN, and how.

Who may connect remotely to company systems, and how.

Scope, approvals and reporting for security testing.

Security checkpoints across the software development life cycle.

Rules for building, exposing and consuming APIs.

What each conditional access policy does and when to use it.

What staff may and may not do with company IT.

Acceptable web use on company devices and networks.

How employees use social media for and about the company.

Rules for email, chat and other work messaging.

Security and equipment rules for people working from home.

Label data by sensitivity and set handling rules for each level.

What must be encrypted at rest and in transit, and how.

How long each type of record is kept, and how it is deleted.

Backup schedules, storage and restore testing.

Controls that stop sensitive data leaving the company.

When and how to mask sensitive data in test and analytics.

Access, encryption and monitoring rules for databases.

Who must be told about a breach, and how fast. GDPR-ready.

Physical access rules for server rooms and data centers.

When e-signatures are valid and how they are handled.

How access is granted, reviewed and removed.

Run periodic reviews of who can access what.

A standard form for new account requests and approvals.

Request and approve access to business applications.

Accounts, devices and access ready on a new hire's first day.

Revoke access and recover devices when someone leaves.

A standard form for IT requests, so nothing gets lost.

List the services IT offers, with owners and timelines.

Response and resolution targets your users can rely on.

Plan, approve and record changes to IT systems.

An ITIL-aligned process for standard, normal and emergency changes.

Keep system and device settings consistent and documented.

Plan routine maintenance across devices and systems.

Assess device security, performance and compliance.

Track every device and license from purchase to disposal.

Wipe and dispose of retired devices securely.

Track what each device costs over its lifetime.

Plan IT spend by category and quarter.

Match IT staff and time to projects and support work.

Roll out device management in a planned order.

Hand over systems and know-how when roles change.

Assess, contract and review your IT vendors.

Gather comparable answers from vendors before you buy.

Align IT decisions with business goals and owners.

Record what happened, the impact and the fix.

Step-by-step actions for the first hours of a breach.

Keep critical systems running through an outage.

Identify, score and treat IT risks.

Assess the risk of a system or new technology.

Move systems or responsibilities without gaps.