68 free IT templates, checklists and policy documents

A structured template for documenting critical business functions, recovery priorities, roles, and communication procedures during a disruption.

A technical DR plan document structure covering systems inventory, RPO/RTO, failover procedures, recovery infrastructure, and post-recovery validation.

A step-by-step disaster recovery runbook structure for recovering a specific system, from pre-recovery checks through verification and rollback.

A structured workbook for organizing scope, evidence, and internal review ahead of a compliance or security audit.

A workbook for scoping the ISMS, running the risk assessment, and preparing for Stage 1 and Stage 2 certification audits.

A workbook for mapping controls to evidence types, building a continuous collection cadence, and tracking evidence quality.

A reusable template structure for writing compliance and security policy documents, with version control guidance.

A workbook for planning Microsoft 365 workload-specific Conditional Access policies — Exchange, SharePoint, Teams, and admin portals.

A workbook for tracking Secure Score improvement actions by architectural layer, to spot imbalanced coverage.

A fill-in-the-blank template for documenting the joiner mover leaver process — your organization's onboarding, role-change, and offboarding procedures — as a repeatable policy rather than institutional memory.

A multi-phase rollout workbook for planning a Conditional Access implementation from baseline to advanced policy sets.

A structured template for documenting network topology, addressing, device inventory, and core services so the network is understandable to more than one person. Copy it straight into your own IT infrastructure documentation, download it, or print it to PDF.

A change request document structure covering description, risk classification, impact assessment, rollback planning, approval, implementation, and post-implementation review.

A structured template for documenting approved AI tools, data classification rules, ownership, and monitoring provisions that govern AI use across the organization.

A policy structure defining permitted and prohibited AI use, data handling rules, disclosure requirements, and consequences for violations.

A checklist for scheduling, executing, and documenting backup restoration tests to confirm backups are actually recoverable.

A checklist organized by incident response phase — Detection, Containment, Eradication, Recovery, and Post-Incident Review.

A worksheet for planning backup strategy by data criticality tier, applying the 3-2-1 rule, and setting retention periods.

A cross-framework checklist covering the core governance and compliance controls most audits and frameworks expect to see in place.

A practical starter checklist of representative CIS Controls Implementation Group 1 (IG1) safeguards across several of the 18 controls.

A checklist organized by the three HIPAA Security Rule safeguard categories — Administrative, Physical, and Technical.

A checklist of representative implementation items organized by NIST SP 800-171 control family, for organizations protecting CUI.

A representative vendor security questionnaire covering data handling, certifications, access controls, incident history, and audit rights.

A practical, printable checklist covering the full Microsoft 365 Security Baseline across identity, email, device, and data.

A recurring administration checklist for keeping an Entra ID tenant healthy over time.

A checklist for rolling out and maintaining Intune security baselines across a device fleet.

A consolidated hardening checklist spanning identity, email, endpoint, device, and data protection across the full cluster.

A step-by-step checklist for rolling out multi-factor authentication without a support-desk avalanche.

A planning worksheet for designing Conditional Access policies before building them in the identity platform.

A checklist covering provisioning, access reviews, and deprovisioning discipline across the identity lifecycle.

A structured worksheet for conducting a periodic identity access review, with fields for findings and remediation.

A practical, printable checklist covering the core credential-security controls every organization should have in place.

A structured checklist for auditing an organization's current password posture before or during a security assessment.

A structured worksheet for comparing password manager vendors before a business-wide deployment decision.

Immediate steps to take when a password compromise is suspected or confirmed.

A cross-framework checklist for confirming password practices align with HIPAA, PCI DSS, and general NIST-based expectations.

A checklist for auditing physical infrastructure, network configuration, virtualization, storage, and monitoring coverage across the environment.

A worksheet for planning VLAN segmentation by traffic type, assigning IDs and subnets, and defining inter-VLAN policy and broadcast domain sizing.

A checklist organized by monitoring domain — compute, network, storage, and alerting discipline — for confirming monitoring coverage is complete and actionable.

A checklist for provisioning a new server consistently — from pre-build planning through OS build, post-build configuration, and validation.

A cross-functional checklist covering documentation, change management, incident and problem management, asset management, monitoring, and continuous improvement.

A self-assessment worksheet structured around the five maturity stages, with indicator questions across documentation, change management, incident/problem management, monitoring, and asset management.

A checklist covering coverage, alert configuration, escalation, and ongoing review for an effective IT monitoring implementation.

A worksheet for scoring the risk of a specific AI use case by data sensitivity, tool trust level, and risk category before approval.

A checklist covering pre-deployment permissions review, pilot phase setup, rollout, and post-deployment monitoring for a Microsoft 365 Copilot deployment.

A playbook of specific response actions for common Microsoft 365 security incident scenarios.

A runbook structure for handling an IT incident from severity classification through resolution, verification, and post-incident documentation.

A staged roadmap for moving from initial AI policy and pilot through controlled rollout, organization-wide adoption, and continuous governance.

A one-page-style reference to the six NIST Cybersecurity Framework 2.0 functions and representative activities for each.

A practical guide to preparing for PCI DSS 4.0 covering scope reduction, the six control goals, and reducing audit burden.

A practical guide to determining your CMMC level, mapping practices to NIST SP 800-171, and preparing for a C3PAO assessment.

A prioritized template for planning and tracking Microsoft Secure Score improvement actions over time.

A phased implementation guide for adopting Zero Trust principles across a Microsoft 365 environment.

A guide to ongoing security operations across the Microsoft 365 security stack — monitoring, review cadences, and incident response touchpoints.

A phased deployment guide for rolling out Defender for Office 365 and Defender for Endpoint across a tenant.

A planning guide for evaluating whether and how to adopt Microsoft Sentinel.

A reference matrix mapping this cluster's security capabilities to the Entra ID and Microsoft 365 licensing tiers that unlock them.

A guide for reducing standing administrative privilege through just-in-time activation, break-glass accounts, and periodic review.

A phased guide for rolling out passkeys and FIDO2/WebAuthn authentication across an organization.

A consolidated reference covering the full set of current identity and authentication best practices in one document.

A reference architecture guide covering how authentication, SSO, Conditional Access, and privileged access fit together as one system.

A step-by-step technical guide for IT administrators implementing a modern password policy across an identity platform.

A concise, non-technical briefing for leadership on why modern password governance matters and what to expect from the program.

A plain-language guide for general staff — not administrators — on what changed in password guidance and what to actually do.

A consolidated reference covering the full set of current password best practices in one document.

A guide for matching storage architecture to workload, planning capacity and performance, and applying appropriate redundancy.

A guide covering what should be documented, documentation quality standards, where documentation should live, and review cadence.

An executive-level guide to why AI governance matters now, the business case for a governed approach, and the specific decisions leadership needs to make.