Resource library
Guides, templates, and checklists for audits, vendor reviews, and privacy programs. Adapt them to your organization, load them into CASK, or ask our team to help.
25 resources · 145 articles · 6 topics
Showing 1-12 of 170
Step 1: Catalog Compliance Requirements Extract all mandatory training obligations from regulations (OSHA, GDPR/CCPA, HIPAA, SOX, industry-specific), internal policies, and customer contrac…
Pro tip: When we first rolled out this playbook at my company, the "12-month-out" trigger saved us from a frantic three-week sprint that almost cost us a qualified opinion.
This template is designed to help audit, risk, and compliance teams keep a tight grip on remediation work.
1. Reporting activity, not risk: Counting patches applied or training sessions completed shows effort but doesn't indicate whether risk is decreasing.
Third-party risk is no longer an edge concern. It's how breaches happen. The 2024 IBM Cost of a Data Breach report found that 46% of breaches involved a third party, with average incident c…
Download a ready-to-use Business Impact Analysis (BIA) template, learn how to fill out RTO/RPO values, avoid common pitfalls, and get actionable steps to integrate the worksheet into your c…
Purpose & Scope: This checklist structures evidence collection for SOC 2 Type II and ISO 27001 audits by mapping Trust Services Criteria and Annex A controls to specific artifacts.
Organizations stumble over this shift for three main reasons. First, legacy GRC processes are built around audit cycles.
Version: 1.0 | Owner: GRC Manager | Review Cycle: Biannual
Purpose & Scope: This template establishes the data processing terms between your organization (as data controller) and its vendors (as data processors) to ensure GDPR-compliant handling of…
The struggle isn't just legal; it's operational. US privacy frameworks like CCPA focus on consumer rights and opt-out mechanisms, while GDPR establishes a comprehensive data protection regi…
Version: 1.0 | Owner: Data Protection Officer | Review Cycle: Annual
Most organizations have a risk appetite statement. Most of them are useless.
Organizations struggle with these incidents for several reasons. First, the speed.
Most organizations that attempt ISO 27001 certification underestimate the first phase.
Version: 1.0 | Owner: Security Operations | Review Cycle: Quarterly
Version: 1.0 | Owner: Vulnerability Management Lead | Review Cycle: Biannual
Role: You are a senior risk facilitator conducting interviews with business unit leaders to identify emerging risks.
Use this risk assessment template to score inherent and residual risk, record controls, assign mitigation owners, and schedule reviews.
The hard part of a security awareness program is rarely the content. It is knowing who completed what, and when, in a form an auditor will accept.
Use this ISO 27001-aligned security policy template to define scope, roles, acceptable use, access control, data classification, and annual review.
These eight prompts cover the policy lifecycle from first draft through board-level communication, for security and GRC teams working against ISO 27001 or NIST CSF.
You've decided to pursue SOC 2 Type II compliance. Good. Now you need to actually get there, and you probably have 90 days or less to make it happen.
Lead This playbook covers the four things that have to happen when a vendor relationship ends: access revoked, data returned or verifiably deleted, contract closed, and residual risk assess…
--- Version: 1.0 | Owner: GRC Team | Review Cycle: Annual or upon regulatory/framework changes
Risk acceptance is a real decision, not a register status. Learn who should sign it, what a defensible acceptance record needs, and when to revisit it.
A staged playbook for putting AI to work in your GRC process: pick a narrow task, ground it in your documents, gate each output, show the value, then scale.
Shadow AI spreads when approved tools are slow and unapproved ones are fast. How compliance teams find it, tier it, and govern it without banning AI use.
Chain of custody for compliance evidence means documenting who handled what, when, and how. Without it, your evidence is just a file anyone could have changed.
Choosing between digital and physical compliance evidence comes down to retrieval speed, audit defensibility, and what your regulators actually require.
A practical redlining process for turning generic compliance policy templates into policies that match your systems, owners, exceptions, and scope.
A practical self-audit framework for trust teams. Find gaps, fix blind spots, and show your program works before external auditors find the problems.
Auditors do not review each item your controls produce; they test a subset. Learn how sample selection works and prepare sampled evidence for review.
A practical metadata schema for compliance evidence: owner, collection date, period covered, source system, control reference, and freshness review.
Auditor requests pile up when nobody owns the process. A coordinator, a tracker, and a response workflow turn fieldwork chaos into predictable delivery.
How to turn a compliance gap review into a remediation map with owners, target states, accepted risks, priority, and evidence needed for closure.
Auditors interview your control owners to check whether documented controls match practice. Here is how to run a prep session that gets each SME ready.
Choosing between SOC 2 and ISO 27001 for your first assurance program? It comes down to your customers, audit model, and where you sell. Here is how to pick.
Organize CMMC preparation around confirmed scope, accountable owners, evidence, remediation, and review milestones.
Prepare for ISO 42001 with a practical workflow for AI inventory, ownership, risk review, evidence, and assessment planning.
A practical NIST CSF 2.0 guide for small teams: define scope, owners, evidence, response work, recovery planning, and review cadence.
SOC 1 and SOC 2 answer different customer questions. One covers your effect on the customer's financial reporting; the other covers security criteria.
Too much compliance documentation buries audit-ready signals in noise. Learn the signs of over-documentation and how to right-size your compliance approach.
A practical guide to managing compliance during mergers and acquisitions, covering pre-deal diligence, transaction execution, and post-close integration.
A practical guide to mapping compliance ownership across engineering, legal, finance, procurement, and operations so handoffs do not become audit gaps.
System migrations quietly break the provenance of compliance evidence. How to preserve context, ownership, and integrity of your records through system changes.
A risk appetite statement only works if people can read it and decide from it. Here is how to write one your team will actually use and auditors will accept.
Risk heat maps fail when color does all the work. How to build one that survives leadership review, stays current, and ties to owners and treatment plans.
Risk registers fail when nobody owns the outcome. Here is how to define risk ownership roles, prevent accountability gaps, and hold people responsible.
Risk register hygiene keeps assessments trustworthy between formal reviews. Learn the review cadence, staleness signals, and ownership checks that work.
AI can propose control mappings, but teams still need a review process for scope, evidence, framework versions, rejected matches, and approval.
A compliance tech stack comes down to a handful of functional categories. This guide maps the categories and the order to adopt them as your program matures.
Tool subscriptions are only one line in a compliance budget. Here is how to build a full cost baseline across people, evidence, audits, and remediation.
A change-control process for security questionnaire answers: owner approval, evidence checks, stale-answer retirement, triggers, and review history.
Turn vendor assessment findings into remediation plans that close: named owners, risk-based timeframes, closure evidence, and a written escalation path.
AI helps compliance teams with evidence gathering and drafting, but breaks down on judgment calls and context. Here's a realistic look at where it works.
Compliance pipeline automation requires the right components in the right order. This guide covers what teams actually build and where they typically get stuck.
AI compliance monitoring watches deployed systems for drift, bias, and control gaps. What practitioners actually track and where programmes fall short.
Set up an AI governance program that actually works in practice — roles, review gates, tool inventory, and artifact management without performative governance.
A practical method for classifying AI systems by risk level, covering decision impact, data sensitivity, recovery cost, and governance changes at each tier.
AI can draft audit paperwork fast. But compliance audits still need human judgment, accountability, and context that no model can own.
Data lineage tracking does not have to be a multi-year enterprise project. A phased approach starting with critical paths delivers compliance value fast.
Governance committees talk without deciding. This guide covers committee design, decision authority, and how to run meetings that produce real outcomes.
BCP test evidence fails audit when teams document activity instead of outcomes. This guide covers what auditors review and how to build defensible evidence.
A practical guide to business impact analysis for compliance teams — what works, where teams get stuck, and how to run a BIA that holds up under real pressure.
Compliance drift detection catches the slow, quiet failures that audits miss. This guide covers how teams build continuous checks and fix what breaks.
How to build a cybersecurity budget justification that wins support by framing security spending in business terms leadership teams understand and act on.
ESG risk assessment breaks down when teams treat it as a reporting exercise. Here is how to build a scalable approach that integrates with your existing work.
Learn how to build financial risk assessments that scale with your organization, from scored models to continuous board monitoring and governance reporting.
Stop counting activity and start measuring risk. A step-by-step guide to building a GRC metrics program that leadership reads, understands, and acts on.
Many GRC teams waste hours on manual documentation and fragmented tools. Here is what to optimise first, based on how compliance teams work in practice.
GRC reporting automation replaces manual spreadsheet reporting with a connected system that pulls evidence, tracks status, and generates audit-ready reports.
A practical guide to developing GRC team skills beyond assurance documents — relationship management, operational thinking, data literacy, and the judgment gap.
A step-by-step guide for compliance teams looking to modernize GRC operations, moving from manual spreadsheets into structured, evidence-grounded workflows.
Compliance programs fail when they rely on mandates alone. This guide covers five practical steps teams use to make compliance habits stick long-term.
Policy document governance turns scattered docs into a working system. This guide covers versioning, approval workflows, periodic review, and clean retirement.
Policy operations turn static documents into governed assets. Build ownership, review cycles, version control, and retirement processes that survive audit.
Recovery time objective planning translates business tolerance into recovery targets. Teams often set wrong numbers. Here is what practitioners actually do.
Practical guide to building cybersecurity team skills through learning systems, role clarity, hands-on practice, and reviewable evidence.
A practical self-assessment for data privacy programs across five maturity levels and five dimensions, from governance and data mapping to vendor privacy risk.
Many security metrics programs fail because teams try to measure everything at once. Start with a focused set, define it properly, and expand deliberately.
Cyber threat data sharing works when teams exchange sanitized indicators through trusted channels with clear handling rules and reviewable evidence.
First compliance audits surface predictable gaps. Learn the six mistakes that trip up first-time auditees and how to fix them before fieldwork begins.
A practical process for tracking compliance gaps from identification through verified closure, with ownership, evidence, and escalation at each step.
Remote work breaks office-built compliance. Here is how to redesign evidence collection, control verification, and policy enforcement for distributed teams.
How to score supplier criticality, structure dual-sourcing, and avoid the traps that leave teams exposed when a single source fails at the wrong moment.
How compliance teams communicate with vendors, suppliers, and relationship owners to manage third-party risk, reduce questionnaire fatigue, and close gaps.
A practitioner playbook for responding to supply chain disruptions — confirm scope, communicate, assess impact, invoke contracts, and document for next time.
Supply chain ESG monitoring goes beyond questionnaires. Learn what compliance teams actually track, where data stalls, and how to build a loop that holds up.
A practical checklist of documents, evidence, and data to collect from vendors during security reviews, organized by risk tier for compliance teams today.
Learn what a gifts and hospitality register should capture, who reviews entries, and how records support later review.
Make conflict of interest declarations useful with clear disclosure triggers, review decisions, recusal records, and refresh points.
A speak-up channel needs more than an inbox. Build intake, triage, case records, outcomes, and follow-up checks that hold up later.
Compliance by design brings review into product decisions early, before launch pressure turns small issues into expensive rework.
Run data subject requests with a clear intake record, identity check, search process, response package, and completion record.
Build compliance training around real decisions, useful records, and completion record instead of generic awareness sessions.
Cyber insurance can support risk management, but it depends on clear controls, accurate records, and follow-through after underwriting.
Separate compliance and legal responsibilities with clear decision owners, handoffs, and records that prevent duplicate work.
Decide where compliance records, processing, and model traffic should live before approving tools that touch sensitive compliance data.
Small compliance teams can manage enterprise expectations by sequencing work, documenting coverage, and focusing effort where it matters some.
Spreadsheet access reviews break down fast. Here is how data owners can review sensitive data access with better context, tighter ownership, and faster remediation.
A practical guide to data catalog implementation — phased approach, common failure modes, and the sequencing that makes catalogs survive past launch day.
Data classification programs fail when the policy sits in a folder nobody opens. Here is what teams that sustain the practice actually do differently.
Much data governance reports track activity instead of progress. This guide covers operating metrics that help governance teams see what is improving, stalling, or drifting.
Data governance fails without clear ownership. This guide covers the three core roles, common failure patterns, and how to assign accountability in practice.
Data lifecycle management spans creation, storage, use, archiving, and deletion. Learn what practitioners actually do beyond writing a retention policy.
Practical data quality validation approaches for compliance teams — how practitioners verify accuracy, catch errors, and maintain trustworthy evidence.
Metadata management for AI compliance agents: the four metadata types that make agent outputs grounded, cited, auditor-accepted, and actually trustworthy.
Most assurance programs collapse under their own weight. A working design starts with scope, evidence standards, and a review cadence that holds up over time.
Compliance debt builds when controls are deferred and findings go unremediated. Learn to identify, measure, and pay down compliance debt before it surfaces.
Financial controls automation reduces manual review cycles and audit prep. Learn what teams automate, what they keep manual, and where automation pays off.
Financial reporting compliance spans SOX-related controls, ICFR practices, and disclosure processes. Learn what practitioners do, where teams struggle, and how to build resilient compliance.
Practical guidance on designing internal controls that actually work — without getting lost in framework specifics, checkbox exercises, or catalog-copying.
SOX readiness means more than a checklist. Learn what practitioners do, where teams struggle, and how to build audit-ready compliance that survives scrutiny.
How to run access certification campaigns that catch real access drift, not just checkbox approvals. Practical steps from scoping through remediation.
Access control implementation fails when teams skip the basics. A practitioner guide to building access controls that survive audits and hold up under pressure.
A practical guide to compliance process automation — what to automate first, what to keep human, and how to sequence the rollout so it actually works.
Data loss prevention strategies that go beyond policy documents. Practical DLP approaches from teams who built programs that actually prevent data loss.
Practical guide to encryption key management: lifecycle controls, audit evidence, and the operational gaps that break key governance across cloud and on-prem.
Identity governance practices that real teams build — lifecycle management, access reviews, privileged access, and where programs stall before they scale.
How to implement least privilege without slowing teams down. A practitioner guide to rightsizing access, handling exceptions, and building a process that lasts.
Privileged access management fails when it becomes shelfware. Here is what practitioners actually do to protect admin accounts without grinding work to a halt.
Teams build access systems backwards, bolting on roles after users multiply. A practical guide to designing roles that scale without permission sprawl.
Sensitive data discovery automation finds personal data, payment info, and credentials across your systems. Here is how it works and where teams get stuck.
Practical walkthrough of SSO implementation: protocol selection, IdP integration, session management, and the failure modes that stall enterprise deals.
Exception queues fill fast when continuous monitoring goes live. Learn how teams disposition, grade, and clear control exceptions without alert fatigue.
Build a risk drift detection practice that surfaces compliance gaps between audit cycles, helping your team catch problems while they are still fixable.
A practical guide to multi-jurisdiction compliance management, cross-border control mapping, evidence reuse, and regulator-ready workflows.
Sub-contractors that vendors fail to disclose create blind spots in risk programs. Here is how to surface them with structured inquiry and technical discovery.
Many vendor risk programs stop at Tier 1. Learn where visibility breaks down and how trust teams build upstream awareness that prevents cascading failures.
Audit trail requirements explained with practical examples for access logs, change records, decision history, retention, and review-ready evidence.
Build audit working papers that support review: structure, evidence, cross-referencing, retention rules, and mistakes that create avoidable review friction.
Evidence hierarchy for compliance teams: rank system records, documents, attestations, and interviews by review strength and practical evidence quality.
Learn how to build a risk treatment plan that survives leadership review with decision structure, recurring failure modes, and practical business language.
Human oversight can make compliance AI reviewable when roles, evidence, escalation, and approval boundaries are designed around risk and expert judgment.
Compliance fire drills happen because nobody owns the calendar. Build an operational cadence that turns periodic obligations into dated, assigned work.
Organise a GDPR documentation set through 11 practical work products, from processing records to DPIAs, processor governance, and breach preparation work.
Some compliance board reports drown directors in activity data. Learn the metrics, framing, and cadence that turn board reporting into a governance tool.
Compare checkbox-oriented compliance with a culture that connects controls, decisions, evidence, and operational risk across daily work and review cycles.
Plan, run, and document incident-response tabletop exercises, then turn observations into compliance evidence, action items, and stronger response routines.
Fourth-party risk is the exposure from subcontractors you did not contract with. Build visibility, write flow-down clauses, and catch concentration risk.
Build a vendor assessment scoring framework that turns subjective evaluation into a repeatable, defensible scoring process for security and compliance teams.
Build a cross-functional vendor governance committee that drives accountability, escalation, and risk-based decisions across your third-party portfolio.
Plan vendor offboarding as a compliance control with access revocation, data destruction, evidence retention, and framework-aligned review steps that matter.
Prepare for SOC 2 by defining scope, mapping controls to applicable criteria, resolving gaps, and retaining evidence on each control's cadence over time.
Prepare for a compliance audit by confirming scope, validating controls, organizing evidence, resolving gaps, and briefing owners before fieldwork begins.
Build a defensible disaster recovery test by defining scope, measuring RPO and RTO results, retaining evidence, and tracking exceptions through remediation.
Choose which compliance work to automate: use machines for repeatable production and keep interpretation, escalation, and approval with people at scale.
Evaluate GRC AI agents for grounding, visible citations, permissions, gap handling, review gates, audit trails, and accountable human decisions in practice.
Compare ISO 27001 certificates and SOC 2 reports by scope, assurance model, reporting period, and Trust Services Categories during vendor review.
Assess vendors by impact, scope, evidence, and change. Apply risk-based due diligence and monitoring throughout the relationship from onboarding onward.
Evidence freshness doesn't have to be a pre-audit scramble. Classify controls, set review cadences, and escalate stale items before they become findings.
Auditors evaluate the trail, not the tool. Learn how citation-backed claims and a review history support the review of AI-assisted compliance work.
Scope your SOC 2 audit from evidence you already keep. Reuse controls from last cycle, draft a cited control list, and flag gaps. The decision stays with you.
Turn your risk register into a leadership proposal. Translate risk data into treatment options, cite evidence behind each risk, and review before it goes up.
The hidden compliance cost isn't writing, it's re-stitching context by hand each cycle. A connected-record model changes what rework means. Here's how.
Each audit, questionnaire, and policy review demands the same re-stitching of evidence to controls. The problem is the operating model, not the headcount.
Compliance teams re-stitch links between controls, policies, risks, and evidence by hand every cycle. A connected record keeps them intact so work accumulates.
See how one compliance agent workspace covers the full PDCA cycle of Plan, Do, Check, and Act from a single shared evidence base without re-entering context.
How to design a complete GRC integration architecture that connects your compliance tools without breaking under API churn, data drift, and maintenance debt.
Integrate security questionnaires with your CRM for deal context, SLA management, response ownership, and shared visibility across sales and security teams.
How to track downstream parties across vendor relationships: approval models, the register fields that matter, notice workflows, and common failure modes.
A practical guide to building a tiered third-party due diligence program that scales with vendor risk, supports review and produces usable evidence.
Build ongoing third-party risk monitoring around triggers, evidence freshness, vendor tiers, ownership, review cadence, follow-up, and issue records.
What a vendor trust center actually proves during third-party risk review, where it stops being useful, and what to request instead of accepting the page.
How to verify that vendors can recover when disruption hits, covering continuity scope, testing evidence, recovery expectations, and contract terms.
A practical guide to auditing how third-party vendors process, store, transfer, and dispose of your organization's data across the full vendor lifecycle.
When a vendor is breached, your team can need to act on incomplete information under tight deadlines. Build a vendor incident response coordination process.
A practical vendor risk tiering framework that sorts vendors by data exposure, business criticality, and access scope so due diligence scales with real risk.
A repeatable workflow for vendor security questionnaire response: intake, triage, ownership, evidence validation, SLAs, and cross-functional coordination.