AI Architecture Risk Review & SDLC Governance
A review template for assessing AI architecture risk and governance across the AI SDLC.
107 Cyber GRC templates
Stop Starting From a Blank Page
Access a curated vault of professional Cyber GRC templates covering AI governance, privacy, cloud security, compliance assessments, third-party risk, incident response, risk management, SDLC, policies, and operating work plans.
Explore the Template VaultPreview. Adapt. Execute.
11 categories107 real templates100% free
AI Governance & Model Risk
Assess and govern AI/ML systems against emerging model-risk and security expectations.
AI & Data Governance
A worksheet for aligning AI governance practices with underlying data governance controls.
AI & Robotics Assessment Template
An assessment template for evaluating risk in AI-driven robotics systems.
Cybersecurity & Generative AI Audit Work Plan
An audit work plan for evaluating cybersecurity controls around generative AI usage.
Information Security Policy — AI (Word)
A ready-to-adapt information security policy covering the safe use and governance of AI systems.
Information Security Policy — AI (PDF)
A print-ready PDF version of the AI information security policy.
AI Model Security Testing
A structured worksheet for testing AI/ML models against common security and robustness risks.
Privacy & Data Protection
Run privacy impact assessments and build out data protection programs across GDPR, CCPA, and PIPEDA.
Data Protection Impact Assessment
A working DPIA template for assessing privacy risk before processing personal data.
Security & Privacy Program Deck (PDF)
A print-ready PDF export of the security and privacy program presentation.
Security & Privacy Program Deck
A presentation covering how to structure and run a combined security and privacy program.
PIPEDA, U.S. Data Privacy & Quebec Law 25 Controls
A combined control set spanning PIPEDA, U.S. state privacy laws, and Quebec's Law 25.
Privacy Needs Assessment Report
A report template for capturing findings from a privacy program needs assessment.
Data Tagging & Labelling Standard
A standard defining how data should be tagged and labelled by sensitivity and classification.
Record Classification Scheme
A scheme for classifying records by sensitivity to drive handling and retention decisions.
Privacy Onboarding SOP
A standard operating procedure for onboarding new hires into privacy and data handling practices.
Privacy Roles & Responsibility Matrix
A RACI-style matrix defining who owns which privacy and data protection responsibilities.
Privacy Training Materials
Ready-to-use training materials for rolling out privacy awareness across a team.
Privacy Test & Validation Report
A report template for documenting privacy control testing and validation results.
Data Record & Retention Project Plan
An end-to-end project plan for standing up a data record-keeping and retention program.
Data Protection Impact Assessment (Alternate)
An alternate-format DPIA worksheet for assessing privacy risk before processing personal data.
CCPA Controls Testing
A controls-testing workbook for validating CCPA compliance in practice.
Data Privacy Impact Assessment (V1)
An earlier-revision general-purpose data privacy impact assessment template.
Data Privacy Impact Assessment (V2)
A general-purpose data privacy impact assessment template.
GDPR Controls Assessment
A working GDPR self-assessment covering the core data protection principles and controls.
PIPEDA Controls Testing
A controls-testing workbook for validating PIPEDA compliance in practice.
Cloud & FedRAMP
Track cloud security configuration and FedRAMP readiness across every major provider.
FedRAMP Assessment (V1)
An earlier-revision FedRAMP control assessment template.
AWS / Azure / GCP / Oracle Workplan
A cross-cloud workplan for tracking security configuration tasks across AWS, Azure, GCP, and Oracle Cloud.
Cloud Security Policy
A ready-to-adapt cloud security policy covering access, data protection, and shared-responsibility expectations.
AWS Config Report
A report template for documenting AWS Config findings and remediation status.
Mapping AWS Security Tools to FedRAMP & NIST
Maps native AWS security tooling to the FedRAMP and NIST controls they help satisfy.
FedRAMP Assessment (V2)
A working FedRAMP control assessment template for tracking implementation and evidence.
Security Frameworks & Controls
Assess against CIS, ISO 27002, NIST 800-53, GLBA, FFIEC, and other major control frameworks.
FFIEC Overview
A general reference workbook covering FFIEC guidance areas.
GLBA Risk Assessment Guide
A narrative guide for running a GLBA risk assessment alongside the workbook version.
GLBA Risk Assessment Template
A fillable GLBA risk assessment workbook.
ISO 27002 Controls
A comprehensive control tracker aligned to ISO/IEC 27002.
NIST 800-53 Controls (V1)
A control tracker structured around NIST SP 800-53.
Federal Financial Institutions Examination Council Overview
A reference document covering FFIEC's role and examination guidance.
FFIEC Assessment
A structured self-assessment aligned to FFIEC examination expectations.
CIS Controls
A working assessment against the CIS Critical Security Controls.
COBIT Controls
A control tracker structured around the COBIT framework.
Dodd-Frank Controls
A controls worksheet for tracking Dodd-Frank compliance obligations.
FFIEC Workbook (V1)
An earlier-stage FFIEC workbook for scoping examination readiness.
GLBA Controls
A control tracker for Gramm-Leach-Bliley Act (GLBA) compliance.
ISA/IEC 62443 Controls
A control tracker aligned to the ISA/IEC 62443 industrial security standard.
NIST 800-53 Controls (V2)
A revised control tracker structured around NIST SP 800-53.
RAG Control Tracker
A red-amber-green control tracker for at-a-glance compliance status reporting.
SAP HANA Security Controls
A control tracker focused on SAP HANA security configuration.
ISA/IEC 62443 Assessment
A working assessment against the ISA/IEC 62443 industrial security standard.
NERC CIP Assessment
A working assessment against NERC CIP requirements for critical infrastructure.
Audit, Assessment & Compliance
Run structured assessments across CMMC, HIPAA, PCI DSS, HITRUST, SOX, and general IT controls.
HIPAA Assessment (V1)
An earlier-revision HIPAA compliance assessment.
HITRUST Assessment (V1)
An earlier-revision HITRUST CSF assessment template.
PCI DSS Assessment (V1)
An earlier-revision PCI DSS self-assessment.
PCI DSS ROC / AOC / SAQ
Templates for the Report on Compliance, Attestation of Compliance, and Self-Assessment Questionnaire under PCI DSS.
NIST CSF 2.0 Questionnaire
A self-assessment questionnaire structured around the NIST Cybersecurity Framework 2.0 functions.
Change Management Assessment Questionnaire (CSV)
A CSV export of the change management assessment questionnaire for easy import.
Change Management Assessment Questionnaire (Excel)
A questionnaire for evaluating the maturity of a change management program.
HIPAA Controls Testing
A controls-testing workbook for validating HIPAA safeguards in practice.
ITGC Tracking & Monitoring Deck
A presentation template for reporting on IT general controls tracking and monitoring.
ITGC Tool Tracker (V2)
A tracker for managing IT general controls testing across systems and owners.
ITGC Tool Tracker (V1)
An earlier-revision tracker for managing IT general controls testing.
SOX Audit / ITGC Audit
An audit workbook covering SOX and IT general controls testing.
CMMC Assessment
A working CMMC self-assessment template for tracking practice-level implementation.
Disaster Recovery & Business Continuity Controls
A control tracker for disaster recovery and business continuity planning.
Insider Risk Assessment
A structured worksheet for identifying and rating insider-risk scenarios.
HIPAA Assessment (V2)
A working HIPAA compliance assessment covering administrative, physical, and technical safeguards.
HITRUST Assessment (V2)
A working HITRUST CSF assessment template for tracking control implementation.
PCI DSS Assessment (V2)
A working PCI DSS self-assessment aligned to the current requirement structure.
Third-Party & Supply Chain Risk
Evaluate vendors, AI/LLM suppliers, and supply-chain risk against NIST-aligned criteria.
AI/LLM Third-Party Risk & Compliance Audit
An audit checklist for assessing AI and LLM vendors on compliance and third-party risk.
Vendor Evaluation Scorecard — CMMI (V1)
A CMMI-based scorecard for scoring and comparing vendors during evaluation.
NIST 800-161 Supply Chain Controls (V1)
A control tracker aligned to NIST SP 800-161 for supply-chain risk management.
TPRM Centralized Checklist (V2)
A centralized checklist for running third-party risk management reviews end to end.
TPRM Centralized Checklist (V1)
An earlier-revision centralized checklist for third-party risk management reviews.
Vendor Evaluation Scorecard — CMMI (V2)
A revised CMMI-based scorecard for scoring and comparing vendors during evaluation.
NIST 800-161 Supply Chain Controls (V2)
A revised control tracker aligned to NIST SP 800-161 for supply-chain risk management.
Incident Response & Vulnerability
Respond to incidents and manage vulnerabilities with ready-to-use playbooks, trackers, and a full worked CVE case study.
Application Security & Vulnerability Remediation Standard
A standard defining how application security vulnerabilities are triaged and remediated.
Standard Operating Procedure — Incident Response (Word)
A full incident response SOP covering roles, escalation, and response phases.
Standard Operating Procedure — Incident Response (PDF)
A print-ready PDF version of the incident response SOP.
Case Study
CVE-2024-21762 Case Study: Chain of Custody
Chain-of-custody documentation from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: Network Topology
The network topology diagram from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: Patch Verification Report
The patch verification report from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: SIEM Alert Evidence
A SIEM alert screenshot from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: SOC Dashboard Evidence
A SOC dashboard screenshot from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: Vulnerability Scan Report
The vulnerability scan report from the worked CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: IR Playbook
The incident response playbook used in the worked CVE-2024-21762 healthcare case study.
Case Study
CVE-2024-21762 Case Study: Walkthrough Guide
A standalone HTML walkthrough guide for the CVE-2024-21762 incident response case study.
Case Study
CVE-2024-21762 Case Study: Incident Tracker
The filled incident tracker from the worked CVE-2024-21762 healthcare case study.
Global Incident Report Template (V2)
A standardized incident report template for documenting security incidents from detection to closure.
Global Incident Report Template (V1)
An earlier-revision standardized incident report template.
Lost Device Playbook
A step-by-step response playbook for lost or stolen devices.
Risk Management & Risk Libraries
Build out risk registers and control libraries using NIST-aligned risk assessment frameworks.
Sample Risk Register
A sample risk register showing how to structure and track risk entries in practice.
Completed Risk Library with All Controls
A fully completed example risk library mapped to its underlying controls.
IT Risk Landscape Guide (Alternate Edition)
An alternate edition of the IT risk landscape guide, covering the same landscape from a different angle.
IT Risk Landscape Guide
A guide to the current IT risk landscape, written for practitioners building a risk program.
Controls Library v1.0
A foundational controls library to seed a risk and controls program.
Risk Library
A second reference risk library for cross-checking or extending your primary register.
NIST 800-30 Risk Assessment
A risk assessment template structured around the NIST SP 800-30 methodology.
Security Architecture, SDLC & Access
Assess secure development lifecycle practices, access controls, and application architecture risk.
Home Network Example
A worked example documenting a home network layout for remote-work security reviews.
Role-Based Access Guide
A guide for designing and documenting role-based access control.
SDLC Overview
A reference workbook covering the stages and controls of the SDLC.
eGRC Implementation Checklist
A checklist for tracking tasks during an eGRC platform implementation.
SDLC Assessment
A structured assessment of secure development lifecycle maturity.
SDLC Controls (V1)
An earlier-revision control tracker for secure development lifecycle practices.
SDLC Controls (V2)
A control tracker for secure development lifecycle practices.
Policies, Standards & Programs
Stand up formal policies and programs, starting with insider threat.
Insider Threat Program Policy
A ready-to-adapt policy establishing an insider threat program.
Insider Threat Program Workbook
A working workbook for tracking insider threat program activities and cases.
Project Plans, SOPs & Operating Templates
Plan and run cross-functional GRC projects with ready-made work plans.
IT Assessment Work Plan
A comprehensive work plan for running an information technology assessment end to end.
Unauthorized Content Use Work Plan
A work plan for addressing unauthorized use of content across the organization.