Resources
IT guides and security policy templates
A library of guides, templates, checklists, cheat sheets, whitepapers, case studies, and datasheets, written in plain language. They cover cloud setup and cost governance, networking, identity, platform configuration, and information security.
Treat the templates and everything else here as general-purpose starting points. Adapt them to how your organization actually works before relying on them, and where a topic touches law, regulation, or insurance, involve a qualified advisor. None of it is legal advice.
The policy templates map to ISO/IEC 27001:2022 Annex A and NIST CSF 2.0. Where one follows a further or different standard, its card says so.
If you want help applying any of this, from a cloud project to a full security program, get in touch.
No resources match. Clear the search or filter, or try a different term.
-
Case study
Replacing per-store AWS Site-to-Site VPN with Tailscale subnet routers
How a multinational specialty tea retailer replaced 10 AWS Site-to-Site VPN connections that carried monitoring traffic with one Raspberry Pi per store running Tailscale as a subnet router.
Open the PDF -
Checklist
Cloud landing zone and account baseline across AWS, Azure, GCP, and OCI
Sixteen controls to put in place before deploying workloads in the cloud. Covers account structure, identity, guardrails, logging, networking, encryption, backup and disaster recovery, operations, and automation, with the corresponding services for AWS, Azure, GCP, and OCI.
Open the PDF -
Datasheet
Identity standards, demystified
How modern web apps authenticate users and access APIs: SAML 2.0, OpenID Connect, OAuth 2.0, FIDO2 passkeys, and SCIM 2.0, with real integration patterns, common pitfalls, a glossary, and a decision guide.
Open the PDF -
How-to guide
Cloud tagging and cost governance across AWS, Azure, GCP, and OCI
A tagging standard and cost-governance habits that work the same way on AWS, Azure, GCP, and OCI: a mandatory tag set, how each cloud enforces it, the cost tools to reach for on each one, and a one-week start plan. Aligned to the FinOps Framework.
Open the PDF -
How-to guide
nginx as a TLS reverse proxy on AWS
A hardened front door for a private backend: VPC segmentation, security groups, a Let's Encrypt certificate, a modern TLS configuration, and automated renewal, on Ubuntu 24.04 and Amazon Linux 2023.
Open the PDF -
How-to guide
Establish a secure server baseline on Linux
A new server setup blueprint: hostname and time, a stable address, an admin account, automatic security updates, logging and auditing, SELinux or AppArmor, and the disk and bootloader decisions. For Debian, Ubuntu Server, and RHEL.
Open the PDF -
How-to guide
Harden Linux against CIS Benchmarks with OpenSCAP
Measure a running server against a CIS Benchmark with OpenSCAP, generate a fix for only the rules that failed, apply it safely, and keep the before-and-after evidence. Covers Fedora, RHEL, and Ubuntu.
Open the PDF -
How-to guide
Set up and secure a new GitHub account and organization
How to configure GitHub securely for a small team. Covers account and commit signing, organization policies, third-party and token access, branch rulesets, and security scanning.
Open the PDF -
How-to guide
Set up and secure a new Microsoft 365 tenant
A security baseline for a small business on Microsoft 365 Business Premium: admin accounts, MFA and Conditional Access, application consent, email protection, sharing defaults, and audit logging, anchored to the CIS benchmark and Microsoft Secure Score.
Open the PDF -
How-to guide
Set up and secure a new Google Workspace organization
A security baseline for a small business on Google Workspace Business Standard: super admin accounts, 2-Step Verification, application and API access, email authentication, Gmail safety, sharing defaults, and the alert rules, mapped to the CIS benchmark.
Open the PDF -
How-to guide
Secure and harden SSH access on Linux
Key-only authentication, a CIS-aligned hardening drop-in, the brute-force defenses sshd now has built in, and when fail2ban is still worth running. Covers crypto policies, an optional second factor, and taking SSH off the public internet. For Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Configure and harden a host firewall on Linux
Configure a default-deny inbound firewall with firewalld, ufw, or nftables. Covers safe SSH access, verification from another machine, and mappings to CIS and NIST guidance for Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Set up a self-hosted WireGuard VPN on Linux
An encrypted tunnel between machines you control: secure remote access to your own network, or a full-tunnel VPN off untrusted Wi-Fi. Server and client setup, routing and NAT, in-tunnel DNS, and its real limits. For Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Set up encrypted, validated DNS on Linux with Quad9
Encrypt your DNS lookups and validate the answers. Covers systemd-resolved with Quad9 over DNS-over-TLS, strict DNSSEC validation, suppressing the resolver your router advertises, and how to verify it. For Fedora, RHEL, Ubuntu, and CachyOS.
Open the PDF -
How-to guide
Configure local VM and backup storage in Proxmox VE
Prepare additional local disks on a Proxmox VE node and give each one a distinct role: an NVMe LVM-thin pool for VM and container disks, an ext4 directory for local backups, and a spare held for future needs. Covers safe disk identification, wiping, content restrictions, and a full restore test. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Configure a trusted Let's Encrypt certificate for Proxmox VE with Cloudflare DNS
Replace the cluster-signed Proxmox VE certificate with a trusted Let's Encrypt one through Cloudflare DNS and the ACME DNS-01 challenge, with no port opened to the internet. Covers the restricted Cloudflare API token, ordering, automatic renewal, and troubleshooting. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Configure Proxmox VE no-subscription updates for a homelab
Point a Proxmox VE homelab at the official pve-no-subscription repository: disable the enterprise stream, keep the Debian base and security repositories, settle the Ceph repository as its own decision, and update with apt full-upgrade. The procedure uses official Proxmox and Debian repositories only. Validated on Proxmox VE 9.2.10 on Debian 13.
Open the PDF -
How-to guide
Configure AMD GPU passthrough to a Windows 11 VM in Proxmox VE
Give a Windows 11 VM exclusive use of an AMD Radeon by PCIe passthrough: IOMMU and isolation checks, an OVMF, Secure Boot, and TPM 2.0 build with VirtIO drivers, exact-ID VFIO binding, a staged cutover that keeps a recovery console, and the reset, backup, and BitLocker gotchas. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Deploy Ubuntu 26.04 LTS Server on Proxmox VE
Create, install, and validate an Ubuntu 26.04 LTS Server VM on Proxmox VE: a q35 and OVMF build with Secure Boot verified down to the certificate marker, VirtIO storage on LVM-thin, guest-agent integration, a UFW and automatic-update baseline, and a restore-tested backup. Validated on Proxmox VE 9.2.10.
Open the PDF -
Cheatsheet
Docker Swarm cheat sheet
The Docker Swarm commands, with what each one does: set up and lock the cluster, run services with rolling updates and rollback, stacks, secrets, overlay networks, node maintenance, teardown, backup and quorum recovery, and troubleshooting. For Docker Engine 29 on Ubuntu Server 26.04 LTS.
Open the PDF -
Cheatsheet
DevSecOps cheat sheet
What to check at every stage of software delivery, with the open-source tools that do it: secrets, code, dependency, container, and IaC scanning, pipeline hardening, SBOMs with signing and provenance, DAST on staging, and patching what is exploited first.
Open the PDF -
Cheatsheet
DNS security records cheat sheet
The DNS records that protect a domain: SPF, DKIM, and DMARC to stop forged mail, MTA-STS and TLS reporting to keep delivery encrypted, DNSSEC to stop forged DNS answers, and CAA to control who can issue certificates. Each comes with what can go wrong and the dig command that checks it, plus a rollout order and free ways to test from outside.
Open the PDF -
Whitepaper
Shadow IT: the silent threat inside your ISMS
What Shadow IT is, why it undermines an ISMS without anyone noticing, and how to find, assess, and govern it. Mapped to ISO/IEC 27001:2022, NIST CSF 2.0, and CIS Controls v8.1, with the risks that are easy to miss and a practical checklist.
Open the PDF -
Whitepaper
A practical ISMS documentation structure for ISO 27001
A reference layout for organizing your ISMS documents that follows how ISO/IEC 27001:2022 (including Amendment 1:2024) is structured: the four Annex A control themes, the management-system clauses 4 to 10 and their mandatory documented information, a full folder tree, and placement notes. A starting point to adapt to how your organization works.
Open the PDF -
Template
Information Security Policy template
The top-level policy in our set: scope, risk, roles, exceptions, and the reporting duties the other policies point back to. Fill in the basics, then tailor it to your industry, regulations, and risks. Free to adapt for your organization.
Download the template -
Template
Acceptable Use Policy template
The everyday rules employees sign, covering passwords, phishing, AI tools, and personal devices. Free to adapt for your organization.
Download the template -
Template
AI Acceptable Use Policy template
The AI companion to the Acceptable Use Policy: the rules for how staff use AI tools, especially generative AI assistants, covering approved tools, data handling, output verification, intellectual property, human oversight, and security, aligned to the NIST AI Risk Management Framework and its Generative AI Profile. Free to adapt for your organization.
Download the template -
Template
Access Control Policy template
Who gets access to what: joiners, movers, and leavers, least privilege, multi-factor authentication, privileged access, and app integrations, with password rules that meet or exceed NIST SP 800-63B-4. Free to adapt for your organization.
Download the template -
Template
Incident Response Policy template
How your team handles a security incident: severity levels and response targets, containment and recovery, the fraud and ransomware paths, and breach notification, following the current NIST guidance, SP 800-61 Revision 3. Free to adapt for your organization.
Download the template -
Template
Incident Response Plan Worksheet
The fill-in companion to our Incident Response Policy: who responds, the outside help arranged in advance, the first-hour steps, severity targets, and an incident log, on two printable pages kept with your offline copies. Free to adapt for your organization.
Download the template -
Template
Data Handling Policy template
Three practical classification levels with handling rules for each, retention with legal holds, and secure disposal. Free to adapt for your organization.
Download the template -
Template
Vendor Risk Management Policy template
How to vet and manage third parties: tiered assessments, contract requirements, monitoring with re-assessment triggers, and clean exits. Free to adapt for your organization.
Download the template -
Checklist
Vendor Security Assessment Checklist
The fill-in companion to our Vendor Risk Management Policy: profile the vendor, set its risk tier, run the review the tier calls for, check the eleven contract terms, and record gaps, risk acceptances, and the outcome. One completed copy is one assessment record. Free to adapt for your organization.
Download the checklist -
Template
Vendor Security Questionnaire template
The vendor-facing companion to our Vendor Security Assessment Checklist: the questions to send when a vendor's published documentation and independent assurance leave what you need to know unanswered, covering data handling, access, subprocessors, incidents, continuity, and supplied software. Free to adapt for your organization.
Download the template -
Template
Business Continuity & Disaster Recovery Plan template
Who takes charge, what comes back first, tested backups, and runbooks covering ransomware and key-person loss. Free to adapt for your organization.
Download the template -
Template
Remote Work & Mobile Device Policy template
Working away from the office: device requirements, personal-device approval, travel rules, and lost-device response. Free to adapt for your organization.
Download the template -
Template
Vulnerability Management Policy template
Scan schedules, risk-based priorities, remediation timeframes, and automated patching with snapshots and rollback. Free to adapt for your organization.
Download the template -
Template
Change Management Policy template
Three change types, two-person approval, rollback plans, and an emergency route with the paperwork after. Free to adapt for your organization.
Download the template -
Template
Encryption Policy template
What to encrypt in transit and at rest, approved methods, the key lifecycle, and secure disposal by destroying keys. Free to adapt for your organization.
Download the template -
Template
Secure Development Policy template
Security requirements and threat modeling at design, secure coding and review, components and SBOMs, security testing, and handling vulnerabilities in what you build, following NIST's Secure Software Development Framework and OWASP ASVS 5.0. Free to adapt for your organization.
Download the template -
Template
Physical and Environmental Security Policy template
Secure areas and entry, monitoring, protection against environmental and utility threats, equipment and media handling, clear desk and clear screen, and secure disposal. Free to adapt for your organization.
Download the template -
Template
Logging and Monitoring Policy template
A companion to our Information Security Policy that sets what gets logged, where the logs live, who reviews them, and how to verify the coverage. Aligned to CIS Control 8, Audit Log Management. Free to adapt for your organization.
Download the template -
Template
Email Security Policy template
The organization-side email protections: SPF, DKIM, and DMARC for your domains, provider filtering, and the mailbox rules that reduce business email compromise, aligned to CIS Control 9, Email and Web Browser Protections. Free to adapt for your organization.
Download the template -
Template
Risk Register template
A ready-to-use register that scores likelihood and impact, colors each risk level, and records treatment, ownership, and acceptance, aligned to ISO/IEC 27001:2022 clauses 6.1.2 and 6.1.3. Free to adapt for your organization.
Download the template -
Template
Asset Inventory template
A ready-to-use inventory of hardware, software, cloud services, and information, with owners, classification, and criticality, plus tabs for keys and certificates, and for approved channels. Aligned to ISO/IEC 27001:2022 Annex A control 5.9 and CIS Controls 1 and 2. Free to adapt for your organization.
Download the template -
Template
Exception Register template
Record approved policy deviations in a ready-to-use register, with safeguards, approvals, expiry warnings, and renewal history, aligned to ISO/IEC 27001:2022 clause 6.1.3. Free to adapt for your organization.
Download the template -
Template
Vendor / Supplier Register template
Keep your third parties in one ready-to-use register, with risk tiers, assessments, contract terms, and re-assessment reminders, aligned to CIS Critical Security Controls Safeguard 15.1 and ISO/IEC 27001:2022 Annex A controls 5.19 and 5.22. Free to adapt for your organization.
Download the template