Frameworks explained
Short, plain-language summaries of the frameworks our templates reference.
NIST CSF 2.0
A voluntary framework of 106 outcomes in six functions (Govern, Identify, Protect, Detect, Respond, Recover). A good common language for any organization.
ISO/IEC 27001:2022
The international standard for an information security management system, with certification by accredited bodies.
SOC 2
An attestation report on controls at a service organization, commonly requested by US clients of SaaS and service providers.
ISA/IEC 62443
The international series for industrial automation and control system security: zones, conduits, security levels and seven foundational requirements.
CLC/TS 50701 and IEC 63452
Railway cybersecurity lifecycle standards built on IEC 62443 and the EN 50126 RAMS lifecycle. IEC 63452 is expected to supersede TS 50701.
Privacy laws: GDPR, PIPEDA and others
Laws such as the EU and UK GDPR, Canada's PIPEDA and Quebec Law 25 govern how businesses collect, use and protect personal information.
Frequently asked questions
Are your templates finished policies?
No. They're guidance templates that give you a structured starting point. You adapt them to your organization and have the final version reviewed.
Will using a template make us compliant or certified?
No template can do that on its own. Compliance depends on what you actually implement and on independent assessment where a framework requires it.
What format are the files?
Microsoft Word (.docx) and Excel (.xlsx), editable in Microsoft 365, Google Docs/Sheets and LibreOffice.
Do you respond to cyber incidents?
No. We're an advisory service. If you're under attack, contact your national cyber agency, your insurer and, if needed, police.
Can consultants use the templates with clients?
The standard licence covers your own organization. Contact us about a consultant licence.