Packs
Documents for running a security function
Each pack is a set of ready-made documents for one job, with a guide that says where to start.
- 27 packs
- 15 domains
- 232 documents
Vulnerability & Exposure Management
2
Vulnerability & Exposure Management
Your scanner reports hundreds or thousands of issues. Nobody agrees which ones matter, who should fix them, or by when. This pack gives you ready-made documents to settle those three questions and keep them settled.
9 documentsPatch Management
Many breaches use a weakness the vendor fixed months earlier. Patching fails for ordinary reasons: nobody tests, a server cannot be restarted, a supplier has not certified the update, or a laptop never connects. This pack gives a small IT team a fixed monthly routine, a fast route for the patches that cannot wait, and a recorded decision for the ones that must.
8 documents
Security Governance & Management
2
Security Exception, Waiver & Segregation of Duties
Every organisation has gaps it cannot close today: a server that cannot be patched, a supplier that cannot use multi-factor sign-in, an administrator who both makes changes and approves them. The danger is the gap nobody wrote down, nobody owns and nobody revisits. This pack gives you the documents to record each gap, decide who may accept it, and make sure it ends.
9 documentsSecurity Policy Management
Most organisations have security policies; few have policies anyone reads. They were copied from a template years ago and name people who have left. When an auditor asks who has read them, nobody can show it. This pack helps you build a smaller set of documents that people follow, keep it current, and prove it has been read.
9 documents
Security Metrics, Reporting & Executive Communication
2
Board Cybersecurity Reporting
Most security reports to a board list what the team did last quarter and colour each line red, amber or green. The board nods and moves on. Nothing is decided, because nothing was put to it. This pack helps you turn a technical status update into a governance conversation.
8 documentsCybersecurity Metrics & Reporting Programme
Most security reports measure what the tools emit: alerts, blocked emails, patches applied. Nobody decides anything differently because of them, and nobody notices when a number is last month’s figure carried forward. This pack builds a small set of metrics that each answer a question someone has to decide on, checks every figure before it is reported, and turns a worsening indicator into a decision on time.
9 documents
Cybersecurity Risk Management
1
Information Security Risk Management
Most risk registers are a list of vague worries such as “cyber attack”, owned by IT and scored once in a workshop. Nothing is decided, so nothing changes before the next audit. This pack helps you run a process that produces decisions: who owns each risk, whether it is acceptable, and what happens next.
9 documents
Third-Party & Supply Chain Security
1
Third-Party Security Risk Management
Every supplier gets the same 200-question audit, whether it runs payments or delivers office plants. Nobody reads the answers, certificates are filed without checking what they cover, and the review stalls after a dozen vendors. This pack helps you assess suppliers in proportion to the harm they could do, so the process scales to all.
9 documents
Identity & Access Management
3
User Access Review
A manager receives a list of 200 accounts, half of them named after roles nobody recognises. The deadline is Friday, so everything is approved in four minutes. Nobody checks the few removals requested. This pack helps you run an access review that produces genuine decisions, not bulk approvals under time pressure.
8 documentsJoiner-Mover-Leaver & Access Provisioning
Joiners get noticed, because they cannot work without access. Leavers get noticed in the audit. Movers are not noticed at all: they collect their new role’s access, keep the old, and after a few moves can do things no single job should allow. This pack runs every start, move and exit from the HR record, gives each role a standard set of access, and checks each month that what should have gone has gone. No identity platform is needed.
8 documentsPrivileged Access Management
Attackers do not need to break in if they can sign in as an administrator. Most serious incidents pass through a privileged account at some point: a daily account with local administrator rights, a service account whose password never changes, an administrator who reads email on the same account that runs the directory. A privileged access management platform helps, but it is not where you start. This pack sets out the controls that matter most and shows how to run each one with the tools you already have.
8 documents
Regulatory & Framework Implementation
4
ISO 27001 Implementation & Certification Readiness
A customer asks for a certificate, so someone buys a toolkit, writes forty policies and books an audit. At Stage 1 the auditor finds a scope nobody can explain, controls copied from Annex A instead of chosen from risk, and no records. This pack sets realistic expectations for a first certification: what it costs, how long it takes, and which decisions determine whether it goes well.
9 documentsNIS2 Implementation & Readiness
NIS2 puts cybersecurity on the management body’s agenda by name. The directive says who is caught, what the management body must approve and oversee, which ten risk-management measures an entity must have, and how quickly significant incidents are reported. Most organisations lose time on the first question and never reach the rest. This pack takes you from “are we in scope?” to a readiness position the board can act on.
9 documentsRegulatory Incident Notification & Reporting
One incident can start three legal clocks at once. A ransomware attack on a NIS2 entity that also holds customer data may need an early warning to the national cyber security team within 24 hours, a notification to the data protection authority within 72 hours, and more reports after that. If the organisation is a bank or an insurer, DORA adds its own reports. Each regime has its own test, its own recipient and its own content. This pack makes the decisions quickly, records them, and gets every report in on time.
7 documentsDORA ICT Risk & Resilience Readiness
DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554. It applies from 17 January 2025. It asks a financial entity to run its ICT, the information and communication technology behind its services, so that it can withstand, respond to and recover from disruption. It has five pillars. Every financial entity meets the same five, and the depth of each depends on what the entity is. So the first question is what you are, the second is which duties that makes yours, and only then is it worth asking how ready you are. This pack takes you through those three in order, and ends with a position your management body can act on.
9 documents
Incident Response & Cyber Crisis Management
2
Security Incident Management
The first serious incident is the wrong time to decide who is in charge, how bad it is, and whether the regulator must hear about it by tomorrow morning. Most teams have a plan nobody has opened, no agreed severity levels, and three legal clocks they only learn about once they are running. This pack gives a small team a working incident capability before it is needed.
11 documentsCyber Incident Exercises & Tabletop Scenario Library
Most incident exercises rehearse a script. Everyone reads their part, the plan is declared fit, and nobody learns that the out-of-hours alert goes to the wrong desk until it does so at 6 a.m. This pack runs exercises that test decisions instead: who decides, how fast, on what facts, and whether the decision would survive a legal clock or the board’s questions the next day.
11 documents
Data & Information Protection
1
Information Classification & Handling
Most organisations that try classification end up in one of two places. Either nothing is labelled and everyone decides for themselves what may be emailed, or everything is labelled Confidential and the label stops meaning anything. This pack avoids both. It gives you three levels, a default that most information never leaves, and a decision based on the harm that could follow, read from the same impact scale your risk register uses. Each level then tells people exactly what to do when they store, share, print, take home, put into an AI tool, keep or throw away the information.
8 documents
Security Awareness & Human Risk
1
Security Awareness Programme
A completion rate tells you who sat a course. It does not tell you whether anyone will report the next convincing email, or call a supplier back before changing their bank details. This pack runs awareness as behaviour change: each campaign names one behaviour, is chosen from your own incidents and risks, and is judged on whether that behaviour moves.
8 documents
Security Assurance & Compliance Operations
2
Security Maturity & Internal Assessment
“How mature is our security?” usually gets a score: 3.2 out of 5, or 64%. A score hides the one weak practice that matters, invites arguments about decimals, and says nothing about what to do next. This pack answers the question differently. Each practice is rated on four levels, on evidence someone else has checked. Each area of the programme takes the level of its weakest practice. Management sets the level each area should reach before the evidence is scored. What comes out is a short list of gaps that matter and a plan to close them, never a single number.
8 documentsSecurity Control Assurance
Most organisations find out whether their controls work once a year, when an auditor or a customer asks for evidence. The weeks before are spent finding records, explaining gaps and hoping the sample comes out clean. This pack moves that work into the year. Each control is written down, tested on a schedule set by its risk, on a sample the tester chooses, by someone who does not run it. A failure becomes a deficiency with an owner, a deadline and a retest. When the audit comes, the answers are already on file.
9 documents
Resilience, Continuity & Recovery
2
Cyber Resilience & Recovery
Most recovery plans were written for a fire or a failed server: switch to the second site, restore last night’s backup, carry on. Ransomware breaks every part of that. Replication copies the damage to the second site. The attacker may have been inside for weeks, so last night’s backup may hold the attacker too. The sign-in directory and the administrator accounts you would recover with may now be the attacker’s. This pack plans recovery for that case as well as the ordinary one. You agree with the business how long each service can be down, check that what it depends on can come back in time, rebuild the foundations first from sources you trust, and let each system back only when it is shown to be clean.
8 documentsBackup & Restore Assurance
Most organisations can show that their backup jobs run. Few can show that the data comes back. A finished job says only that it wrote something. It does not say that the data restores, that it restores within the time the service can wait, or that an attacker holding your administrator credentials could not have reached the copy and deleted it first. Attackers look for backups early. This pack sets the backup standard that your recovery objectives rely on, protects the copies, and proves each one by restoring it, checking the result and timing it.
8 documents
AI Security & Emerging Technology
2
AI Security Governance & Acceptable Use
Most organisations do not build AI. They use other people’s AI: an assistant inside the office suite, a forecasting feature in a system they already run, a chatbot a supplier offers, or a free tool a member of staff finds on their own. Governing that use starts with knowing what is in use. For each use, you then decide what data it may touch, who answers for it and how much checking it needs. This pack gives you the policy, the list, the decisions and the training to do that in proportion to the risk, and a position that your leadership team can act on.
8 documentsGenerative AI Security
An LLM application puts instructions and data in one channel. The model reads the organisation’s instructions and an attacker’s words as the same kind of thing, so the checks that work for ordinary input, such as matching a field against a pattern, cannot tell them apart. The national cyber centres and OWASP both say the defence lies in the system around the model, because the model will sometimes be fooled. Everything the organisation already does for access, logging, secure development, patching and supplier assurance still applies and is not repeated here. This pack adds what is specific: what the model may read, what its output may reach, what it may do, who approves what it does, and how the organisation tests all of this before release and watches it afterwards. The result is counts of features reviewed, checks verified and findings open. It is never one score.
8 documents
Specialist High-Value Operating Packs
1
Security Questionnaire & Due Diligence Response
A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.
8 documents
CISO / Security Function Operations
1
CISO Transition, Handover & First 90 Days
A new security leader inherits a programme described by other people. Some of it is real, some of it is written down and not done, and some of it is a hope. The first months are for finding out which is which, and for saying little that cannot be kept. Listen first. Check what you hear against a record, a test or a system. Agree in writing who decides what while you learn. Then record where you started, in counts and in words, so that in a year you can show what changed. The result is a baseline and a plan. It is never one score.
9 documents
No pack matches those words.