Templates, registers and playbooks.
Every course produces an artifact; the resource library holds the blank versions and the guides that go with them. Selected guides are open to free members; templates and registers come with Practitioner membership.
Policy and standards library
Baseline policies with merge tokens, ready to adopt. Free members get the essentials; paid tiers unlock the rest.
Acceptable Use Policy
[POLICY] [SME] Personnel-facing rules of acceptable system, data, and resource use; includes GenAI use boundaries.
Artificial Intelligence Acceptable Use Policy
[POLICY] [SME] Responsible use of AI/ML and generative tools: approved use, data-handling limits, human accountability. NIST AI RMF, ISO 42001, EU AI Act.
Code of Conduct
[POLICY] [SME] FCPA, UK Bribery Act, SOX, Dodd-Frank, EU Whistleblower Directive; ethics and compliance framework.
Password Standard
[STANDARD] [SME] Modern NIST SP 800-63B guidance; length over complexity; breach-corpus checking; no forced rotation.
Email and Instant Messaging Standard
[STANDARD] [SME] SPF/DKIM/DMARC p=reject, MTA-STS, DANE, BIMI, secure email practices.
IT Security Policy
[POLICY] [SME] Master IT Security Policy — apex of the policy library; foundational organisational commitment to information security.
Policy templates provided by a sponsor of the association.
Reading a SOC 2 report in ten minutes
Where the opinion, scope, exceptions, CUECs and subservice organizations are, and what to do with each.
Become a member to readYour first obligation register
From one regulation to a register with owner and evidence per obligation.
Become a member to readDSAR runbook
Intake, identity verification, datastore search, vendor sub-requests, SLA clock, response pack.
Practitioner membershipCUEC register
Every complementary control from your critical vendors, mapped to an internal control, owner and evidence.
Practitioner membershipMarketing list scrub
Opt-in cleansing, suppression against opt-outs and Do Not Sell, consent expiry. From PRV-240, which is free.
Become a member to readContract clause playbook
DPAs, BAAs, security schedules and right to audit, with fallback positions by vendor tier.
Executive Practitioner