Compliance Templates
Audit-ready compliance frameworks and checklists
EU Cyber Resilience Act Workbook
Article 14 reporting readiness and the road to December 2027 — the scope test, the reporting clocks, Annex I requirements mapped to controls, the technical documentation set, and conformity assessment routes. Neither DORA nor NIS2 covers this.
SOC 2 Readiness Accelerator
20-tab SOC 2 program covering assessment through Type 2 audit — 100+ controls, 35 required policies, 7 pre-populated operational logs, and an executive dashboard with three auto-calculated readiness metrics.
HIPAA Readiness Accelerator
The 23-tab HIPAA programme workbook — Privacy Rule, Breach Notification and all three safeguard sets in one place, plus IoMT, telemedicine, AI clinical decision support, biometric and pediatric registers, BAA tracking, evidence, training and an executive dashboard. Largest product in the catalogue.
ISO 27001:2022 Readiness Accelerator
20-tab ISMS implementation workbook for ISO 27001:2022 — all 93 Annex A controls across 4 themes, 11 new 2022 controls, Clauses 4–10 ISMS framework, transition gap analysis from 2013, and policy library.
PCI DSS v4.0.1 Readiness Accelerator
12-tab PCI DSS v4.0.1 workbook — all 12 requirement domains, SAQ type selector, 51 future-dated requirements tracker, e-commerce script security controls, and QSA-ready evidence register. Built for the March 2025 mandatory transition.
CMMC 2.0 Readiness Accelerator
12-tab CMMC 2.0 workbook — all 110 NIST 800-171 practices with DoD SPRS weights, auto-calculated SPRS score, Level determination decision tree, SSP builder, POA&M tracker, and C3PAO readiness checklist. Phase 2 is suspended; the self-assessment, the SPRS score and DFARS 7012 are not.
DORA + NIS2 EU Compliance Workbook
14-tab EU regulatory compliance workbook covering all 5 DORA pillars, NIS2 Article 21 measures, dual framework applicability decision tree, penalty calculator (2% DORA / €10M NIS2), and cross-framework mapping across 17 control domains.
NIST CSF 2.0 Self-Assessment Workbook
14-tab NIST CSF 2.0 workbook — all 106 Subcategories with verbatim NIST.CSWP.29 outcome statements, Current/Target tier dropdowns, Organizational Profile Generator, heatmap, gap analysis pre-seeded with 12 high-gap 2026 scenarios, and crosswalks to SP 800-53r5, SP 800-171r3, CIS Controls v8.1, and ISO 27001:2022.
GDPR & DPIA Compliance Workbook
20-tab GDPR compliance workbook — Controller ROPA, Processor ROPA, DSR log with 30-day SLA tracking, 72-hour breach deadline calculator, TIA template, DPF certification tracker, and DPIA template with WP29 9-factor trigger test. Updated for April 2026 research baseline.
2026 US Privacy Program Workbook
17-tab US state privacy compliance workbook covering the 20-state wave — CCPA/CPRA, MODPA, VCDPA, CPA, and 16 more — with auto-generated obligation matrix, DSR tracker, consent management log, ADMT register, and enforcement reference.
CCPA Cybersecurity Audit & Privacy Risk Assessment Kit
The assessment kit and audit workplan California actually asks for — applicability calculator, per-activity risk assessment template and register, ADMT addendum, the 18-component audit workplan with auditor-independence checklist, report skeleton, and the §7124 certification cover. Assessments for existing processing are due 31 December 2027.
EU AI Act Compliance Clock
Transparency is live; high-risk is December 2027. Classify every AI system you provide or deploy, close the Article 50 duties that already apply, and run the deployer and provider programmes to the date that binds each one — with the US state overlay alongside.
PCI DSS for Healthcare Kit
Healthcare takes card payments too — and PCI is assessed separately from HIPAA by people who do not care that you have a Security Rule programme. One control set for both, the SAQ decision that vendors keep getting wrong, and the dual clock when an incident touches PHI and cardholder data at once.
HIPAA Security Rule 2027 Readiness Kit
The 2027 Security Rule is already written. "Addressable" disappears — MFA, encryption, an asset inventory with a network map, 72-hour restoration, annual audits, six-monthly scans and annual business-associate verification all become required. Get ahead of it while OCR keeps enforcing the current rule.
UK Cyber Security & Resilience Act Kit
MSPs are in scope, and it is twenty-four hours to notify. The CAF-aligned kit for the UK Bill — scope test, CAF v4.0 crosswalk, 24/72-hour notice templates, the MSP customer-notice duty, designated-supplier readiness, and the map to NIS2 and DORA.
CRA Conformity Package
Full CRA applies 11 December 2027 — the technical file, the SBOM and the CE declaration, ready to fill. Classify by core function, meet Annex I, choose the route, build the Annex VII file, ship the SBOM, declare the support period, sign the Annex V declaration.
SOC 2 Readiness Checklist (Type I & II)
The key controls, evidence items, and policy gaps auditors check at every SOC 2 engagement — organized by Trust Service Criteria with a pre-audit readiness rating.
HIPAA Compliance Checklist 2026
Updated for the 2026 Security Rule Final Rule — covers all 12 new mandatory requirements plus the core Administrative, Physical, and Technical safeguards in a single actionable checklist.
Critical Infrastructure Regime Kit
One baseline, every regulator. Power, pipelines, water, rail and nuclear — which regimes bind each asset, what changed in 2026 and what lands by 2030, twenty control families mapped across all of them, and the incident clocks that run in hours.
M365 Security Posture Kit
Assess what a compromised Microsoft 365 account can actually reach, and close the gaps, before an insurer or auditor asks. Licence-tier-aware blast-radius scoring, a CIS-aligned hardening baseline, and one identity review covering Conditional Access, Entra ID Protection and PIM.
Google Workspace Security Posture Kit
Assess what a compromised Google Workspace account can actually reach, scored against your edition, and close the gaps before an insurer or auditor asks. The Workspace counterpart to the M365 kit, built around the two blind spots a login audit cannot see: a granted OAuth token, and shared-drive sharing that looks like a leak.
Okta / Identity Provider Security Posture Kit
What a compromised Okta account or a leaked API token can reach — not one suite's mailbox and files, but every downstream application Okta fronts. The identity-provider layer of the Cloud Identity Posture set, with API tokens and OAuth scope creep weighted the way a trust root deserves.
Salesforce Security Posture Kit
What a misconfigured Salesforce org actually exposes — to a compromised user, a malicious OAuth grant, or an anonymous visitor who never logged in. The 2025–2026 breach wave did not start with a compromised account, and this kit scores the two entry points that did it above the one the other posture kits share.
GitHub / GitLab Security Posture Kit
What a leaked CI/CD secret, a poisoned Action tag or an overprivileged pipeline token can actually reach, and whether you would know before your published packages did. The 2025–2026 supply-chain incidents needed no compromised identity at all, and this kit scores the workflow mechanics that let them through.
AI-Built / Vibe-Coded App Security Posture Kit
Your AI builder shipped fast. Did it also ship a public database, a leaked API key, and a coding agent that will run whatever it reads next? A stack assessment, not a platform one — builder, database, hosting, AI coding tool and MCP, embedded agent — for the founder who needs to know what is exposed before it becomes an incident.
Android Application Security Posture Kit
What a decompiled APK, a rooted device or an intercepted connection can actually reach, scored against OWASP MASVS v2.0 rather than a generic checklist. Hardcoded secrets pass Play Protect; only a review catches them. The Android half of a mobile pair whose scores are directly comparable with the iOS kit.
iOS Application Security Posture Kit
A locked-down platform does not mean a locked-down app. What a jailbroken device, a decompiled IPA or an intercepted connection can actually reach, scored against OWASP MASVS v2.0. App Store review does not catch a hardcoded key either. The iOS half of a mobile pair whose scores are directly comparable with the Android kit.
Docker & Kubernetes Security Posture Kit
An exposed dashboard with no password, a pod's auto-mounted token, a wildcard RBAC binding, an etcd port on the internet: one attack chain from container to cloud account. Docker and Kubernetes assessed together in a single pass, scored against both CIS benchmarks, for the platform team that inherited the cluster.
AWS Cloud Infrastructure Posture Kit
Three in four scanned AWS accounts have something publicly exposed right now. What one exposed S3 bucket, one over-permissioned IAM role or one leaked access key can actually reach — scored against the CIS AWS Foundations Benchmark v3.0.0. First of a three-cloud trilogy on one scoring scale.
Azure Cloud Infrastructure Posture Kit
One compromised identity reached Key Vault, Storage and Virtual Machines in minutes, in a chain Microsoft's own security team documented in 2026. Azure's dominant risk is identity, not raw exposure, and this kit is shaped for it: Key Vault and Storage weighted highest, both the CIS Azure and Microsoft Cloud Security Benchmarks cited, and no re-run of the Entra ID review M365-01 already did. Second of the three-cloud trilogy on one scoring scale.
Google Cloud Platform Posture Kit
Google Cloud has the best network-exposure numbers of the three clouds by a wide margin, and almost exactly the same identity problem as the other two. This kit is about the gap between those facts: 8% exposed, 87% with weak IAM. Scored against CIS GCP Foundation Benchmark v4.0.0, with an AI/ML workload surface the other two cloud kits do not have. Third of the trilogy on one scoring scale.
Enterprise Data Warehouse & AI Pipeline Security Posture Kit
Every table in your warehouse was access-controlled for the analyst who queries it by hand. None of that was written for a nightly retraining job, a RAG layer or a write-back agent. One assessment across Snowflake, Databricks, BigQuery or Redshift and the AI layered on top — with two blast-radius surfaces no other kit has: what the RAG layer can reach, and who can rewrite what the AI tells every employee.
NYDFS Part 500 Compliance Kit
Certification is April 15 — this decides whether you can sign it. A 19-section crosswalk whose summary produces the Certification-vs-Acknowledgment recommendation, all sixteen 500.3 policy areas with board-approval tracking, both filing forms pre-drafted with a two-signatory review record, the 72-hour and 24-hour notice templates, and the board report mapped to the six 500.4(c) topics.