8 free templates
Vulnerability trackers, patch schedules, risk registers, hardening checklists, and the logs that prove the work happened.
Each one is free as a print-ready PDF, and most include an editable CSV. One form unlocks the whole library.
A scanner gives you findings. What auditors, boards, and your own future self need is the thing scanners do not produce: who owns each finding, when it is due, and what happened to the ones you decided not to fix. This tracker is built around the remediation clock rather than the scan.
Patching breaks things, which is why teams delay it, which is why they get breached through something with a patch available for six months. This schedule is built around deployment rings, so a bad patch hits a pilot group of twenty people rather than the whole company.
Risk registers fail in one of two ways: everything scores medium, or the register is written once for an audit and never opened again. This one forces a treatment decision and a review date on every row, because a risk with neither is a note, not a managed risk.
DMARC enforcement is straightforward to configure and easy to get wrong in a way that silently drops legitimate mail. The whole method is to inventory your senders first and move the policy in stages while watching reports.
Hardening guides run to hundreds of settings, most of which nobody verifies afterwards. This baseline is the subset that materially reduces risk, with the deviation register that makes exceptions visible rather than silent.
Annual click-through training produces a completion certificate and no behaviour change. A programme that works is short, frequent, role-specific, and measured against behaviour rather than against attendance.
A simulation programme that always sends easy lures produces flattering numbers and teaches nothing. Recording difficulty alongside results is what makes the trend meaningful rather than a function of how gentle you were feeling.
A golden image goes stale from the moment it is captured, and a six-month-old image means every new device spends its first hours downloading patches on an unprotected build. The refresh cadence matters more than the build quality.
