Templates & checklists
Practical, ready-to-use policies, standards, worksheets, checklists and runbooks for the identity work that recurs. Copy them, adapt them to your environment, and put them to work. No email gate, no sign-up.
A practical checklist for running an access certification campaign that auditors accept and managers actually complete.
A planning worksheet for conditional access policies: a naming standard, a policy inventory table (users, apps, conditions, grant, session, exclusions, report-only date, owner), a baseline set of policies in three phases, an exclusions register and a go-live checklist.
The identity and trust features enterprise buyers check before they sign: SSO (SAML and OIDC), SCIM, audit logs, RBAC, admin console, session controls, data residency and SOC 2, each with the question buyers ask and the evidence to have ready.
An organization-level IAM policy you can adopt and edit: scope, roles, joiner-mover-leaver, MFA, privileged access, access reviews, non-human identities and exceptions, with each clause mapped to ISO/IEC 27001:2022 Annex A and NIST SP 800-53 Rev. 5.
Notification checklists and fill-in message templates for a credential or session compromise: the GDPR, NIS2 and SEC clocks from official sources, what each notice must contain, and customer, regulator and internal messages with identity-specific actions.
A starting runbook for responding to a suspected account takeover or identity compromise: contain, investigate, recover, and learn.
Copy-ready RFP questions for workforce IAM and SSO, CIAM, PAM, IGA and ITDR, plus security, pricing and exit questions, each with a note on why it matters and what a weak answer looks like.
A step-by-step joiner, mover and leaver procedure with a fill-in SLA table, the evidence auditors sample for each event, and the control each step maps to in NIST SP 800-53 (AC-2, PS-4, PS-5) and ISO/IEC 27001:2022.
A fill-in authentication standard built on NIST SP 800-63B-4: assurance tiers per user population, which factors are allowed at each tier, phishing-resistant requirements, reauthentication timeouts, password rules and account recovery.
A checklist for deploying passkeys to the workforce or customers without breaking recovery.
A fill-in privileged access policy: what counts as privileged, separate admin accounts, standing versus just-in-time access, credential vaulting and rotation, session recording, privileged access workstations, break-glass accounts and reviews, mapped to ISO 27001 8.2 and NIST AC-6.
Make sure a departing employee or contractor actually loses access everywhere, promptly, with evidence.
A fill-in policy for service accounts, API keys, OAuth apps, workload identities and AI agents: ownership, approved credential types and maximum lifetimes, rotation, inventory fields, monitoring and decommissioning, mapped to the OWASP Non-Human Identities Top 10 and NIST SP 800-53.
A fill-in policy for contractor, partner, vendor support and integration access: sponsorship, individual identities, expiry, MFA, just-in-time vendor sessions, OAuth app approval, reviews and offboarding, with lessons from fan-out and help desk breaches.