Resources
Templates, checklists and sample documents
Everything here is free and grouped by what sent you looking. A renewal application, a customer questionnaire, an audit, or a board meeting. Take what you need and use it without talking to us.
One thing worth saying up front. Every document on this page is something you can produce yourself. That is the point of giving them away. The one thing on this list you cannot produce yourself is the attestation, because the whole value of an attestation is that somebody independent signed it.
Looking for guides rather than documents? Testing the plan, and proving it collects every guide on this site about testing an incident response or business continuity plan.
renewal
Your cyber insurance renewal is coming up
The window opens about ninety days out. These are for the part where the application asks what you have tested.
- What these are
- A control-by-control checklist and a sourced figure sheet.
- When to use them
- From about ninety days before your renewal date, before the broker sends the application back for a second pass.
- Why they help
- Most of the application you can answer from documents you already hold. The checklist tells you which line is the exception, and the figures are there for the internal conversation about paying for it.
- Read it
Cyber Insurance Renewal Readiness Checklist
Which controls and which evidence your carrier will check this year, control by control.
- Read it
Canadian Cyber Incident and Insurance Stat Sheet
Current Canadian cyber incident and insurance numbers, each with its primary source and year, for the internal case you have to make.
questionnaire
You are filling in a questionnaire right now
A renewal application or an enterprise customer security review. The questions look simple and are not.
- What these are
- A plain-English decode of the ten questions, and a finished report to compare against.
- When to use them
- With the form open, before anybody ticks a box.
- Why they help
- The questions are short and the answers are binding. Knowing what a yes commits you to, and what the finished evidence looks like, is what stops a claim being argued over later.
- Read it
Carrier Questionnaire Decoder
What each incident-response question actually means, what counts as evidence, and what a yes commits you to.
- Read it
Sample After-Action Report
What a finished after-action report looks like, including the signed attestation page, so you know what you are being asked to produce.
audit
You are preparing for an audit
SOC 2, ISO 27001, or an enterprise customer who wants to see the evidence rather than hear about it.
- What these are
- A three-hour agenda and the skeleton of the report it produces.
- When to use them
- When you have decided to run something and need to know what good looks like before you start.
- Why they help
- It is annotated with what an auditor and an underwriter each look for, which are not the same thing. You can run the session from it without us.
- Read it
Tabletop Agenda and AAR Template
A one-page three-hour agenda and the after-action report skeleton, annotated with what an auditor and an underwriter each look for.
board
You are briefing the board
One page, written to be forwarded, with no jargon that will need explaining in the meeting.
- What these are
- One page: four questions, a strong answer and a weak answer for each.
- When to use them
- Ahead of the meeting, forwarded into the pack rather than presented.
- Why they help
- It gives the board language for the follow-up question, which is the one that finds the gap. Management can answer the first question easily and rarely the second.
- Read it
Board Cyber-Readiness One-Pager
Where your cyber readiness stands and what the board should ask next, in a page that fits on a phone screen.
scenarios
You want to run one yourself
Run these quarterly with your own team. They build the muscle. They do not produce third-party attestation, and page one of each says so.
- What these are
- Three ready-to-run scenarios, five injects each, with the decision points marked.
- When to use them
- Quarterly, between whatever formal exercise you run once a year.
- Why they help
- Repetition is what makes the decisions fast under pressure. These build the habit. They do not produce third-party attestation, and page one of each says so.
- Read it
Ransomware Scenario Pack
A ransomware scenario with five injects and the decision points, ready to run.
- Read it
Business Email Compromise Scenario Pack
A business email compromise scenario with five injects and the decision points.
- Read it
Third-Party Breach Scenario Pack
A third-party breach scenario, for when the incident is your vendor and not you.
Not published
Four you have to ask us for
Five of the nine are on this site in full, free, with nothing to fill in. The other four are not published anywhere, and each now has a page of its own that says what is in the file before you decide whether you want it.
The sample after-action report is the whole of the deliverable a paid engagement produces, attestation page and all. The three scenario packs each carry facilitator sheets that say, on their face, not to hand them out, because the room is meant to be surprised by them. Publishing either would defeat the thing. So those four go to a named person by email instead.
Take the templates. Book the witness.
Everything on this page is yours to run yourself. The one thing it cannot give you is somebody independent signing to say it happened.