Free templates · yours to adapt
Every policy, checklist, incident plan and register marked in Shit, I've Been Hacked! — as documents you can type into, sort, and drop your own business name into. Nothing held back, and none of it costs money.
Subscribe to SteadyPoint Cyber emails to unlock immediate access to all 27 templates.
Subscription is required to access the library. We'll handle your email as described in our Privacy Policy.
Choose an individual template below, or download the complete pack as an optional ZIP.
The ZIP is optional. Every template is also available individually below.
Download safety: the pack contains standard PDF, Word and Excel files only — no macros, executables or password protection. Files are checked before publication.
The library
Open one, make it yours, and put it to work. Each is a starting point — not a finished document — so adjust it to how your business actually runs.
The 8-step Emergency Action Card. Print it, fill in your numbers, stick it on the wall.
Who's responsible, who decides, and how you prepare and recover. Pairs with the Emergency Action Card.
Makes verify-by-phone the required way you handle payments and bank-detail changes.
The 7-step card for the single most-exploited action in any business. Laminate it.
Who can initiate, who must approve, and what verification each payment needs.
Ten questions to pin down and document your payment authority. Review it yearly.
A ready-to-paste fraud warning for your email signature — puts customers on alert too.
The one-page baseline policy — SMB1001 Control 21. Your house rules, in plain English.
How your devices, accounts and data may be used. The do's and don'ts, on a page.
Individual accounts, MFA, least privilege, and clean joiner/leaver handling.
What you back up, the 3-2-1 rule, and how you know a restore actually works.
The one-page rules from Chapter 10 — SMB1001 Control 27. What AI can and can't touch.
Access right on day one, and gone on the last day. The two riskiest moments, handled.
Keep software current with the least effort — the cheapest high-impact control.
Simple rules for phones, laptops and working away from the office.
The sortable one — dropdowns for likelihood, impact and status, and five worked examples.
Two tabs: your digital assets, and every third party with access — tiered by risk.
Thirty minutes, six five-minute passes, the same every quarter. Treat it like a BAS date.
A five-minute Bronze / Silver / Gold sanity check. The gaps are next quarter's agenda.
Lock your side of Microsoft 365 / Google Workspace — the 9-point Chapter 4 checklist.
If you only do five things, do these. Most people finish in under an hour.
The no-blame poster for the moment after a wrong click. Print it near every desk.
One 10-minute topic a month, tailored to your team.
The 10 MSP questions and 5 SaaS questions, with what a good answer looks like.
Agree who owns what with your IT provider, so nothing falls through the gap.
Five signals that should end a cyber sales conversation. Don't get fleeced.
How to make them yours
These are starting points. The fastest way to fit one to your business is to hand it to an AI assistant with a prompt like this — straight from the book:
Two rules though: start a fresh chat, and never paste real customer names, bank details or staff records into a free AI tool. Chapter 10 of the book explains why, and what to use instead.
Where to next
Take the free 12-minute Cyber Check and we'll tell you which of these to reach for first, and in what order.
Take the free Cyber Check →These templates are the do-it-yourself path. When a job's fiddly or the clock's against you, we can tailor, review and sign one off with you. That's the DI(m)Y™ promise.
See how it works →The authorities the book leans on — all free, all worth knowing before you need them.