24-Document Policy & Template Suite
A complete security governance library aligned to the ASD Essential Eight at Maturity Level 1. Not a handful of generic templates — everything your business needs to document, manage, and demonstrate its security posture.
Why Do You Need Policies?
Technical controls protect your systems. Policies protect your business. Without documented policies, you cannot demonstrate to insurers that you have a security program, prove to clients that you manage their data responsibly, show auditors that your controls are deliberate and maintained, or hold staff accountable for security responsibilities.
Most cyber insurance applications now ask whether you have documented security policies, an incident response plan, and a business continuity plan. The answer needs to be yes — and you need to be able to produce them.
Core Governance Policies
The foundation of your security program — what your organisation commits to, what staff must follow, and how access is controlled.
Information Security Policy
The overarching policy covering all 8 Essential Eight controls, roles, responsibilities, and compliance requirements.
Acceptable Use Policy
IT usage rules — internet, email, AI tools, BYOD, social media, prohibited activities, and monitoring.
Password & Access Control Policy
Password standards, MFA requirements, privileged account management, and credential breach response.
Data Classification & Handling Policy
Three-tier classification (Public, Internal, Confidential) with handling, storage, and disposal rules.
BYOD Policy
Approval, security requirements, MDM, data separation, lost device procedures, and privacy boundaries.
Change Management Policy
Request, assess, approve, and document changes to IT systems with Standard/Normal/Emergency categories.
Incident Response & Recovery
When something goes wrong — ransomware, BEC, data breach, or business disruption — your team needs a plan, not a panic.
Incident Response Plan
6-role IRT, 4-tier severity matrix, 5-phase response framework with communication procedures.
Ransomware Playbook
8-step response from isolation through recovery. 37-item checklist. Plan testing with 4 scenarios.
BEC Playbook
Type A/B framework with AiTM attack coverage. Financial recall procedures. 32-item checklist.
NDB Response Checklist
6-step Privacy Act compliance. 30-day assessment window. OAIC notification. 30-item checklist.
Business Continuity Plan
Business impact analysis, 6 disruption scenarios, system recovery priority order, vendor dependencies.
Security Incident Tracking Log
31-field incident records across 6 sections. INC-YYYY-NNN format. 3 blank forms.
Operational Policies
Day-to-day security — remote work, backups, physical security, vendor management, and offboarding.
Remote Work Policy
Home network security, VPN requirements, BYOD for remote work, and incident reporting.
Backup & Restoration Policy
3-2-1 rule, immutable copies, 12-field backup register, quarterly restoration testing.
Clean Desk & Clear Screen Policy
Screen locking (Win+L / Ctrl+Cmd+Q), 9-item end-of-day checklist, document handling.
Vendor Risk Assessment
~100 questions across 15 sections. "What Good Looks Like" guidance. Low/Med/High scoring.
Employee Offboarding Policy
30-item checklist, access revocation, device recovery, pre-departure data review.
Checklists, Forms & Registers
Practical tools that turn your policies into daily operations — onboarding, monthly maintenance, access requests, and asset tracking.
New Employee Onboarding Checklist
50-item checklist across 7 categories. MFA enrolment, device setup, policy sign-off, training.
Monthly IT Security Maintenance
46 items mapped to all 8 E8 controls. Dual sign-off. 24-month retention for evidence.
Privileged Access Request Form
5-part lifecycle: request → approval → provisioning → annual revalidation → revocation.
Staff Security Acknowledgement
8 policy checkboxes, 4 training checkboxes, 9 obligation checkboxes. Annual re-sign.
Hardware & Software Asset Register
10-column hardware, 9-column software, 9-column network tables with examples.
Quick Reference Guides
Print-friendly guides for all staff. Plain language, colour-coded steps, designed to be kept at workstations.
What to Do If You Click a Bad Link
5 colour-coded steps. "Don't panic" tone. "You will not be in trouble for reporting."
Secure Remote Work Checklist
36 items across setup, daily habits, and public spaces. Five Rules summary card.
What Makes These Different?
Built for Australian SMBs
Written for businesses with 10–50 staff. References the Privacy Act 1988, NDB scheme, OAIC, ACSC, and Fair Work Act. No enterprise jargon — practical language your team will understand.
Cross-Referenced
Every document cross-references the others. The Incident Response Plan references the playbooks. The onboarding checklist references the policies. The monthly checklist references the asset register. They work as a system.
Tailoring Guidance Built In
Every document includes guidance on what to customise and what to remove. Comprehensive templates with clear direction on trimming them to fit your actual environment.
E8 ML1 Aligned
Patching timeframes, MFA requirements, application control, privileged access controls, and backup standards are all consistent with the ASD Essential Eight Maturity Level 1.
Audit & Insurance Ready
Version control tables, management approval boxes, and review dates on every governance document. The monthly checklist provides ongoing evidence that your controls are maintained.
Professionally Formatted
Consistent design system across all 24 documents — branded cover pages, colour-coded callout boxes, structured tables, and print-friendly layouts. Replace the logo and they look like yours.
The Alternative?
Hiring a consultant to write these from scratch.
Replace placeholder text with your business details, add your logo, remove sections that don't apply, and you have a professional policy document ready for management sign-off. Every template includes guidance notes explaining what to customise and why.
24 documents. Professionally formatted. E8 ML1 aligned.
Policies in minutes — not months.
Get the DIY Package →