Free Security Checklists & Templates
These are working documents for security practitioners: checklists, templates, worksheets, and evaluation frameworks you can use in an audit, a tabletop exercise, a vendor evaluation, or a planning meeting. Each one is written for a specific audience, such as CISOs, SOC leads, cloud and platform engineers, AppSec teams, or security awareness owners. Each explains when to use it, walks through the items with a short rationale, and lists the common pitfalls to avoid. Where it helps, they map to established guidance from NIST, CISA, OWASP, and the CIS Controls. Every resource links to a longer article with the background and reasoning, and all of them are free to print or save as PDF.
Shadow AI Audit Checklist
Free shadow AI audit checklist to discover unsanctioned AI tools and agents, assess data and credential risk, and put practical governance in place.
Zero Trust AI Assessment Framework
Assess zero trust readiness for AI agents and ML workloads across identity, data, network, and monitoring, mapped to NIST SP 800-207 and CISA guidance.
PQC Migration Timeline Planner
Plan your post-quantum cryptography migration: crypto inventory, prioritization, hybrid pilots, and rollout aligned to NIST FIPS 203, 204, and 205.
CEM ROI Calculator
Estimate the ROI of a continuous exposure management (CEM/CTEM) program with a transparent worksheet for labor savings, risk reduction, and tool consolidation.
SBOM Generation Template
SBOM template covering NTIA minimum elements, CycloneDX and SPDX fields, build-time generation, signing, and VEX for software supply chain security programs.
SOC Analyst AI Skills Checklist
Assess SOC analyst readiness for AI-assisted triage, investigation, and response with a skills checklist, a simple proficiency scale, and training guidance.
AI Agent Risk Classification Worksheet
Classify AI agents by data sensitivity, autonomy, and operational scope, then assign low, medium, or high control tiers with this free risk worksheet.
Machine Identity Inventory Template
Free template to inventory service accounts, API keys, certificates, workload identities, and AI agents with owners, permissions, and rotation status.
Behavioral Detection Playbook
Detect and respond to AI-assisted, polymorphic malware with behavior-based detections mapped to MITRE ATT&CK, plus a step-by-step incident response runbook.
Enterprise Deepfake Defense Checklist
Defend against deepfake voice and video fraud with verification protocols, payment controls, help desk checks, training, and a response plan for attacks.
API Security for AI Agents Checklist
Secure the APIs your AI agents call: scoped credentials, object-level authorization, prompt injection defenses, rate limits, and logging mapped to OWASP.
CSPM Evaluation Framework
Evaluate cloud security posture management (CSPM) platforms with weighted criteria for coverage, detection quality, remediation, compliance, and operations.
Ransomware Response Playbook Template
Ransomware response playbook template covering backup readiness, roles, detection, containment, recovery, and communications, based on CISA and NIST guidance.
Edge Security Assessment Checklist
Assess edge computing and IoT device security: hardware roots of trust, secure boot, signed firmware updates, device identity, segmentation, and monitoring.
AI Security Culture Playbook
Build a security culture program for generative AI with role-based training, AI champions, safe reporting, a clear usage policy, and behavior metrics.