Resources
IT guides and security policy templates
A library of practical guides, templates, checklists, cheat sheets, whitepapers, case studies, and datasheets, written in plain language and ready to use. They cover cloud setup and cost governance, networking, identity, platform configuration, and information security.
The templates and other resources here are intended as general-purpose starting points. Adapt them to how your organization actually works before relying on them, and where a topic touches law, regulation, or insurance, involve a qualified advisor. Nothing here should be considered legal advice.
The policy templates map to ISO/IEC 27001:2022 Annex A and NIST CSF 2.0. Where one follows a further or different standard, its card says so.
If you want help applying any of this, from a cloud project to a full security program, get in touch.
No resources match. Clear the search or filter, or try a different term.
-
Case study
Replacing per-store AWS Site-to-Site VPN with Tailscale subnet routers
How a multinational specialty tea retailer replaced 10 AWS Site-to-Site VPN connections that carried monitoring traffic with one Raspberry Pi per store running Tailscale as a subnet router.
Open the PDF -
Checklist
Cloud landing zone and account baseline across AWS, Azure, GCP, and OCI
Sixteen foundational controls to establish before deploying workloads in the cloud. Covers account structure, identity, guardrails, logging, networking, encryption, backup and disaster recovery, operations, and automation, with the corresponding services for AWS, Azure, GCP, and OCI.
Open the PDF -
Datasheet
Identity standards, demystified
How modern web apps authenticate users and access APIs: SAML 2.0, OpenID Connect, OAuth 2.0, FIDO2 passkeys, and SCIM 2.0, with real integration patterns, common pitfalls, a glossary, and a decision guide.
Open the PDF -
How-to guide
Cloud tagging and cost governance across AWS, Azure, GCP, and OCI
A tagging standard and cost-governance habits that work the same way on AWS, Azure, GCP, and OCI: a mandatory tag set, how each cloud enforces it, the cost tools to reach for on each one, and a one-week start plan. Aligned to the FinOps Framework.
Open the PDF -
How-to guide
nginx as a TLS reverse proxy on AWS
A hardened front door for a private backend: VPC segmentation, security groups, a Let's Encrypt certificate, a modern TLS configuration, and automated renewal, on Ubuntu 24.04 and Amazon Linux 2023.
Open the PDF -
How-to guide
Establish a secure server baseline on Linux
A new server setup blueprint: hostname and time, a stable address, an admin account, automatic security updates, logging and auditing, SELinux or AppArmor, and the disk and bootloader decisions. For Debian, Ubuntu Server, and RHEL.
Open the PDF -
How-to guide
Harden Linux against CIS Benchmarks with OpenSCAP
Measure a running server against a CIS Benchmark with OpenSCAP, generate a fix for only the rules that failed, apply it safely, and keep the before-and-after evidence. Covers Fedora, RHEL, and Ubuntu.
Open the PDF -
How-to guide
Set up and secure a new GitHub account and organization
A practical guide to configuring GitHub securely for a small team. Covers account and commit signing, organization policies, third-party and token access, branch rulesets, and security scanning.
Open the PDF -
How-to guide
Set up and secure a new Microsoft 365 tenant
A security baseline for a small business on Microsoft 365 Business Premium: admin accounts, MFA and Conditional Access, application consent, email protection, sharing defaults, and audit logging, anchored to the CIS benchmark and Microsoft Secure Score.
Open the PDF -
How-to guide
Set up and secure a new Google Workspace organization
A security baseline for a small business on Google Workspace Business Standard: super admin accounts, 2-Step Verification, application and API access, email authentication, Gmail safety, sharing defaults, and the alert rules, mapped to the CIS benchmark.
Open the PDF -
How-to guide
Secure and harden SSH access on Linux
Key-only authentication, a CIS-aligned hardening drop-in, the brute-force defenses sshd now has built in, and where fail2ban still earns its place. Covers crypto policies, an optional second factor, and taking SSH off the public internet. For Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Configure and harden a host firewall on Linux
Configure a default-deny inbound firewall with firewalld, ufw, or nftables. Covers safe SSH access, verification from another machine, and mappings to CIS and NIST guidance for Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Set up a self-hosted WireGuard VPN on Linux
An encrypted tunnel between machines you control: secure remote access to your own network, or a full-tunnel VPN off untrusted Wi-Fi. Server and client setup, routing and NAT, in-tunnel DNS, and its real limits. For Fedora, RHEL, Ubuntu, and Arch-based systems.
Open the PDF -
How-to guide
Set up encrypted, validated DNS on Linux with Quad9
Encrypt your DNS lookups and validate the answers. Covers systemd-resolved with Quad9 over DNS-over-TLS, strict DNSSEC validation, suppressing the resolver your router advertises, and how to verify it. For Fedora, RHEL, Ubuntu, and CachyOS.
Open the PDF -
How-to guide
Configure local VM and backup storage in Proxmox VE
Prepare additional local disks on a Proxmox VE node and give each one a distinct role: an NVMe LVM-thin pool for VM and container disks, an ext4 directory for local backups, and a spare held for future needs. Covers safe disk identification, wiping, content restrictions, and a full restore test. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Configure a trusted Let's Encrypt certificate for Proxmox VE with Cloudflare DNS
Replace the self-signed Proxmox VE certificate with a trusted Let's Encrypt one through Cloudflare DNS and the ACME DNS-01 challenge, with no port opened to the internet. Covers the restricted Cloudflare API token, ordering, automatic renewal, and troubleshooting. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Configure Proxmox VE no-subscription updates for a homelab
Point a Proxmox VE homelab at the official pve-no-subscription repository: disable the enterprise stream, keep the Debian base and security repositories, decide the separate Ceph repository deliberately, and update with apt full-upgrade, using official repositories only. Validated on Proxmox VE 9.2.10 on Debian 13.
Open the PDF -
How-to guide
Configure AMD GPU passthrough to a Windows 11 VM in Proxmox VE
Give a Windows 11 VM exclusive use of an AMD Radeon by PCIe passthrough: IOMMU and isolation checks, an OVMF, Secure Boot, and TPM 2.0 build with VirtIO drivers, exact-ID VFIO binding, a staged cutover that keeps a recovery console, and the reset, backup, and BitLocker gotchas. Validated on Proxmox VE 9.2.10.
Open the PDF -
How-to guide
Deploy Ubuntu 26.04 LTS Server on Proxmox VE
Create, install, and validate an Ubuntu 26.04 LTS Server VM on Proxmox VE: a q35 and OVMF build with Secure Boot verified down to the certificate marker, VirtIO storage on LVM-thin, guest-agent integration, a UFW and automatic-update baseline, and a restore-tested backup. Validated on Proxmox VE 9.2.10.
Open the PDF -
Cheatsheet
Docker Swarm cheat sheet
The Docker Swarm commands, with what each one does: set up and lock the cluster, run services with rolling updates and rollback, stacks, secrets, overlay networks, node maintenance, teardown, backup and quorum recovery, and troubleshooting. For Docker Engine 29 on Ubuntu Server 26.04 LTS.
Open the PDF -
Cheatsheet
DevSecOps cheat sheet
What to check at every stage of software delivery, with the open-source tools that do it: secrets, code, dependency, container, and IaC scanning, pipeline hardening, SBOMs with signing and provenance, DAST on staging, and patching what is exploited first.
Open the PDF -
Whitepaper
Shadow IT: the silent threat inside your ISMS
What Shadow IT is, why it quietly undermines an ISMS, and how to find, assess, and govern it. Mapped to ISO/IEC 27001:2022, NIST CSF 2.0, and CIS Controls v8.1, with the risks that are easy to miss and a practical checklist.
Open the PDF -
Whitepaper
A practical ISMS documentation structure for ISO 27001
A reference layout for organizing your ISMS documents, mirroring how ISO/IEC 27001:2022 (including Amendment 1:2024) is structured: the four Annex A control themes, the management-system clauses 4 to 10 and their mandatory documented information, a full folder tree, and placement notes. A starting point to adapt to how your organization works.
Open the PDF -
Template
Information Security Policy template
The foundation of our security policy set: scope, risk, roles, exceptions, and the reporting duties every other policy points back to. Fill in the basics, then tailor it to your industry, regulations, and risks. Free to adapt for your organization.
Download the template -
Template
Acceptable Use Policy template
The acceptable use companion to our security policy set: the everyday rules employees sign, from passwords and phishing to AI tools and personal devices. Free to adapt for your organization.
Download the template -
Template
AI Acceptable Use Policy template
The AI companion to the Acceptable Use Policy: the rules for how staff use AI tools, especially generative AI assistants, covering approved tools, data handling, output verification, intellectual property, human oversight, and security, aligned to the NIST AI Risk Management Framework and its Generative AI Profile. Free to adapt for your organization.
Download the template -
Template
Access Control Policy template
The access control companion to our security policy set: joiners, movers, and leavers, least privilege, multi-factor authentication, privileged access, and app integrations, with password rules that meet or exceed NIST SP 800-63B-4. Free to adapt for your organization.
Download the template -
Template
Incident Response Policy template
The incident response companion to our security policy set: severity levels and response targets, containment and recovery, the fraud and ransomware paths, and breach notification, following the current NIST guidance, SP 800-61 Revision 3. Free to adapt for your organization.
Download the template -
Template
Incident Response Plan Worksheet
The fill-in companion to our Incident Response Policy: who responds, the outside help arranged in advance, the first-hour steps, severity targets, and an incident log, on two printable pages kept with your offline copies. Free to adapt for your organization.
Download the template -
Template
Data Handling Policy template
The classification companion to our security policy set: three practical levels, handling rules for each, retention with legal holds, and secure disposal. Free to adapt for your organization.
Download the template -
Template
Vendor Risk Management Policy template
The vendor and supply chain companion to our security policy set: tiered assessments, contract requirements, monitoring with re-assessment triggers, and clean exits. Free to adapt for your organization.
Download the template -
Checklist
Vendor Security Assessment Checklist
The fill-in companion to our Vendor Risk Management Policy: profile the vendor, set its risk tier, run the review the tier calls for, check the eleven contract terms, and record gaps, risk acceptances, and the outcome. One completed copy is one assessment record. Free to adapt for your organization.
Download the checklist -
Template
Vendor Security Questionnaire template
The vendor-facing companion to our Vendor Security Assessment Checklist: the questions to send when a vendor's published documentation and independent assurance leave your specific questions unanswered, covering data handling, access, subprocessors, incidents, continuity, and supplied software. Free to adapt for your organization.
Download the template -
Template
Business Continuity & Disaster Recovery Plan template
The recovery companion to our security policy set: who takes charge, what comes back first, tested backups, and runbooks from ransomware to key-person loss. Free to adapt for your organization.
Download the template -
Template
Remote Work & Mobile Device Policy template
The remote work companion to our security policy set: device requirements, personal-device approval, travel rules, and lost-device response. Free to adapt for your organization.
Download the template -
Template
Vulnerability Management Policy template
The scanning and patching companion to our security policy set: scan schedules, risk-based priorities, remediation timeframes, and automated patching with snapshots and rollback. Free to adapt for your organization.
Download the template -
Template
Change Management Policy template
The change control companion to our security policy set: three change types, two-person approval, rollback plans, and an emergency route with the paperwork after. Free to adapt for your organization.
Download the template -
Template
Encryption Policy template
The encryption and key management companion to our security policy set: what to encrypt in transit and at rest, approved methods, the key lifecycle, and secure disposal by destroying keys. Free to adapt for your organization.
Download the template -
Template
Secure Development Policy template
The secure development companion to our security policy set: security requirements and threat modeling at design, secure coding and review, components and SBOMs, security testing, and handling vulnerabilities in what you build, following NIST's Secure Software Development Framework and OWASP ASVS 5.0. Free to adapt for your organization.
Download the template -
Template
Physical and Environmental Security Policy template
The physical and environmental security companion to our security policy set: secure areas and entry, monitoring, protection against environmental and utility threats, equipment and media handling, clear desk and clear screen, and secure disposal. Free to adapt for your organization.
Download the template -
Template
Logging and Monitoring Policy template
A companion to our Information Security Policy that defines what gets logged, where logs are stored, who reviews them, and how logging coverage is verified. Aligned to CIS Control 8, Audit Log Management. Free to adapt for your organization.
Download the template -
Template
Email Security Policy template
The organization-side email protections: SPF, DKIM, and DMARC for your domains, provider filtering, and the mailbox rules that reduce business email compromise, aligned to CIS Control 9, Email and Web Browser Protections. Free to adapt for your organization.
Download the template -
Template
Risk Register template
The risk tracking companion to our security policy set: a ready-to-use register that scores likelihood and impact, colors each risk level, and records treatment, ownership, and acceptance, aligned to ISO/IEC 27001:2022 clauses 6.1.2 and 6.1.3. Free to adapt for your organization.
Download the template -
Template
Asset Inventory template
The asset management companion to our security policy set: a ready-to-use inventory of hardware, software, cloud services, and information, with owners, classification, and criticality, plus tabs for keys and certificates, and for approved channels. Aligned to ISO/IEC 27001:2022 Annex A control 5.9 and CIS Controls 1 and 2. Free to adapt for your organization.
Download the template -
Template
Exception Register template
The exception management companion to our security policy set: a ready-to-use register of approved policy deviations, with safeguards, approvals, expiry warnings, and renewal history, aligned to ISO/IEC 27001:2022 clause 6.1.3. Free to adapt for your organization.
Download the template -
Template
Vendor / Supplier Register template
The vendor management companion to our security policy set: a ready-to-use register of your third parties, with risk tiers, assessments, contract terms, and re-assessment reminders, aligned to CIS Critical Security Controls Safeguard 15.1 and ISO/IEC 27001:2022 Annex A controls 5.19 and 5.22. Free to adapt for your organization.
Download the template