Governance Templates
Policies, procedures, and board reporting templates
Post-Quantum Migration Kit
The board will ask about quantum. Have the inventory and the plan — one row per cryptographic use, a Mosca check that tells you whether you are already late, four migration waves, a vendor questionnaire with hard stops, and the deadline calendar behind all of it.
Synthetic Media & Deepfake Defense Kit
Thirty seconds of audio clones a voice. Defend your executives, staff and brand from cloned voices and fake video — and produce AI-generated content with the consent, disclosure and provenance every platform and regime now requires. Two halves: Defend and Produce.
Agentic AI Security Program Kit
Your AI agents can act — book, email, deploy, pay. Inventory them, fence them, test them, log them: 27 fields per agent, a blast-radius tier, a guardrail standard with per-action gates, OWASP ASI threat modelling with 18 test cases, and the playbook for the hour after one goes wrong.
Shadow AI Inventory & Risk Scoring Workbook
Discover, inventory, and score every unapproved AI tool in your environment — 10 tabs, 589 formulas, pre-seeded with 15 real-world shadow AI tools and a defensible 10-factor risk model.
vCISO Client-in-a-Box
27 tabs, 1,565 formulas — a complete client management system for solo vCISOs and small teams. NIST CSF 2.0 assessments, risk registers, roadmaps, and a portfolio dashboard for 20 clients. Includes the 584-paragraph Practitioner User Guide.
2026 CISO Budget Workbook
Input five values on the Assumptions tab — revenue, IT budget, headcount, industry, maturity — and the entire workbook calculates itself. Three budget-sizing methods, 50+ line items, CRQ for boards, and board talking points with your actual numbers.
CISO Board Reporting Pack
Everything you need to brief the board on cybersecurity — editable Excel metrics workbook, 25-slide PowerPoint deck template, and a user guide covering what boards actually want to hear and how to answer the questions you will get.
CISO 90-Day Onboarding Workbook
The 12-tab assessment workbook for a CISO joining a company — stakeholder mapping, a deep program gap assessment against the frameworks that organization cares about, quick-win tracker, board briefing builder, and the 30/60/90-day milestone framework. For the employed CISO who needs the analysis in depth; if you are arriving fractionally, on an interim basis, or into a seat nobody has held before, start with The First 100 Days Kit.
Director's Cyber Oversight Kit
What a director should ask, and what a good answer looks like. Twelve questions with the good-answer and weak-answer patterns, the evidence log that proves oversight happened, and the charter, calendar and self-assessment regulators, plaintiffs and insurers now expect. No technical background assumed.
OT Security Program Kit for the Plant
Segment the plant, fence vendor remote access, survive the outage. For the plant with a flat network, a vendor VPN, SCADA on an ageing hypervisor and a safety PLC on the same VLAN — the IEC 62443 zones-and-conduits programme, sequenced for a plant that cannot stop.
Executive Tabletop Exercise Kit
Eight board-ready scenarios, ninety minutes each — 64 injects that each name the decision they force and the question to ask the room, a decision log that pre-fills and scores itself on time-to-decide, and an after-action report carrying the regulatory evidence statement for NYDFS 500.16(d), DORA Art. 11 and NIS2 Art. 20. A billable engagement in a box.
Security Metrics & KPI Library
Stop reporting patch counts. 86 defined metrics with formulas, source systems, starting targets and an anti-gaming note each, mapped to CSF 2.0 / ISO 27001 / CIS v8 / SOC 2 and to the regimes that pull them — plus the twelve to start with at any maturity, a protection-level sheet that turns targets into priced decisions the board owns, and a dashboard that rolls one data-entry sheet into board, exec and ops views.
The First 100 Days Kit
New seat, empty seat, or fractional seat — the hundred days that decide your tenure. Four entry modes auto-filter a 34-task plan, a 14-domain baseline including AI governance and personal liability, a budget builder in percent of revenue and IT, and the role charter and fractional engagement letter with a no-certification-without-verification clause.
SEC 8-K Item 1.05 Materiality Workbook
Four business days — have the materiality process before you need it. 12-factor scoring with Known/Unknown flags, a timestamped clock log that evidences "without unreasonable delay", computed 8-K and 8-K/A deadlines, and the language-to-avoid table for the wording that enforcement has actually punished.