Built for the work,
not the optics.
ciso.diy exists because security teams spend too much time building documentation from scratch — and most of what's available is either a checklist dressed up as a deliverable or a $500/month platform for something that should cost $79 once.
What we're replacing
- ✕ Blank spreadsheets that take 20 hours to build and look amateur when you present them
- ✕ $15 Etsy templates with generic checklists and no formulas, no logic, no output
- ✕ $500–$2K/client/month platforms that are overkill for a solo vCISO or a 20-client book
- ✕ Consulting deliverables you paid $10K for once and can never update yourself
What we deliver
- ✓ Workbooks with real logic — formulas that roll up, dashboards that update, outputs you can share
- ✓ Practitioner-grade depth — the kind of detail that holds up in front of a board, a broker, or an auditor
- ✓ One-time pricing — you own it, you can update it, you don't pay again next month
- ✓ Honest documentation — user guides that tell you the limits, not just the features
How we build
Practitioner-built
Every template comes from someone who has sat in the chair — run the assessment, presented to the board, argued with the underwriter. Not designed by marketers, not generated by AI, not padded to look impressive.
Tangible outputs
The test: can you hand it to someone outside your team and have it mean something? If a template only makes sense to the person who built it, it failed. Everything here produces a deliverable.
Honest about tradeoffs
The vCISO workbook tells you at what client count it breaks down. The Shadow AI workbook tells you the weights are tunable because no two orgs are the same. We'd rather you use the tool correctly than oversell what it does.
Priced for the work, not the market
A $15 Etsy template and a $299 workbook are not the same thing. We price on depth, defensibility, and the hours it replaces — not on what competitors charge.
How the program works
Most of what we publish is one thing: the AI Security Department — the architecture CISO Marketplace runs for clients, written down so you can build it on your own estate. It is a sequence, not a shelf. You can start anywhere, but it was designed to be walked in order.
- Phase 0
The Enterprise AI Risk Assessment
Map the estate before you architect for it — the current-state map, the future-state design, and the sequence to build the six pillars in.
-
The 6 pillars
Each is a capability you can build and run independently. Buy the sequence your risk dictates rather than making one all-or-nothing decision.
01Map controls once, satisfy every framework — driven from your registry, not a platform’s integrations.
02Discovery, scanning and AI triage across 100+ apps, in one self-healing risk register.
03An authorized, sandboxed lane that proves the bug and drafts the patch, under a human gate.
04A reducer over your existing stack: read every alert, resolve the routine, escalate the few.
05An operating system for the worst day — one room, one clock, and 90% of the choices already made.
06The capstone hub — every stream above feeds one register a human owns, conducted out to the board.
- C2
Six capabilities are only a department if one seat conducts them — intake, the gates, one register, and observability over every AI channel.
All 6 pillars are published, along with Phase 0 and the C2 capstone. Several carry companion build systems — where the pillar guide carries the method, the companion carries the running system: a control graph as an actual database, a risk register that knows what has gone stale, the hardened box the whole thing runs on.
Build it, or have it built
The same architecture is sold at four levels of done-for-you. Every rung links to the ones above and below it, and no rung pretends the others do not exist — the guides are explicit about where doing it yourself stops being the cheaper answer.
securitygadgets.shop
Open-firmware machines and hardware keys. Nothing here requires them — the builds are hardware-agnostic — but several build sheets name these exact SKUs.
ciso.diy — you are here
The guides, the schemas, the prompt packs and the workbooks. One-time price, yours to extend.
cisomarketplace.services
The managed program. Same architecture, delivered and operated — including a commissioned Operator Node with documented provenance for anyone heading into diligence.
What's in the catalog
125 products and 74 bundles, from $4.99 up — the program above, plus the workbooks, assessments and libraries that sit around it. Every one built to the same standard.
Browse the full catalog →The ecosystem
ciso.diy is one piece of a broader set of tools built for security practitioners. Each property solves a different layer of the same problem — doing more security work with less overhead.
The managed version of everything here. The same six pillars and the same architecture, delivered as a service by people who run it — for teams who would rather buy the outcome than build it. Every guide on this site names its managed counterpart.
cisomarketplace.services/programThe US channel for the hardware these builds run on — Nitrokey keys and HSMs, NovaCustom open-firmware laptops and mini-PCs. Several guides here name those exact machines in their build sheets, and every SKU is mapped to NIST 800-53, ISO 27001, SOC 2, NIS2, CMMC and CIS v8.
securitygadgets.shopThe practitioner community and vendor directory the rest of it grew out of — fractional CISO listings, a vetted vendor directory, and the membership that ties the ecosystem together.
cisomarketplace.comAI-generated cybersecurity policies on demand. Information security policies, incident response plans, and compliance frameworks — generated in minutes, not weeks.
generatepolicy.comPre-built cybersecurity policy templates mapped to SOC 2, ISO 27001, HIPAA, PCI DSS, and NIST CSF. Ready to customize and deploy.
cyberpolicy.shopCybersecurity document templates — policies, procedures, runbooks, and frameworks for building and maturing security programs.
cybertemplates.com82 specialized micro cybersecurity tools. Risk calculators, compliance checkers, policy generators, and assessment tools — instant access, zero deployments.
microsec.toolsGet in touch
Questions about a product, a bulk or team purchase, white-label licensing, or something we haven't built yet — reach out directly.
compliance@ciso.diy