Free readiness resources
Free Tools and Templates
Find out where you stand before an auditor does. Free checklists and tools for ISO 27001, ISO 42001, SOC 2 (System and Organization Controls 2), NIS 2 (the EU Network and Information Security Directive), NIST (National Institute of Standards and Technology) frameworks, CMMC (Cybersecurity Maturity Model Certification), the GDPR (General Data Protection Regulation) and the EU AI Act.
All tools and templates
Pick your role to see the most useful tools first, or filter by framework.
Readiness checklists
Short, honest checklists that show where you stand against each framework. Free with your email.
-
ISO 27001
ISO 27001 Readiness Checklist
Assess your information security management system before a Stage 1 review.
Get the checklist : ISO 27001 Readiness Checklist -
ISO 42001
ISO 42001 Readiness Checklist
Assess your AI management system readiness.
Get the checklist : ISO 42001 Readiness Checklist -
GDPR
GDPR Compliance Checklist
A twelve-point check of your GDPR readiness.
Get the checklist : GDPR Compliance Checklist -
SOC 2 New
SOC 2 Readiness Checklist
Scope your system and check your controls against the Trust Services Criteria.
Get the checklist : SOC 2 Readiness Checklist -
EU AI Act New
EU AI Act Readiness Checklist
Inventory and classify your AI systems against the dates now in force.
Get the checklist : EU AI Act Readiness Checklist -
NIS 2 New
NIS 2 Readiness Checklist
Check whether you are in scope and ready for the 24-hour reporting clock.
Get the checklist : NIS 2 Readiness Checklist -
NIST New
NIST CSF 2.0 Readiness Checklist
Score yourself across the six Cybersecurity Framework (CSF) functions, including Govern.
Get the checklist : NIST CSF 2.0 Readiness Checklist -
NIST New
NIST SP 800-53 Readiness Checklist
Pick your baseline and check the control families an assessor will test.
Get the checklist : NIST SP 800-53 Readiness Checklist -
NIST New
NIST SP 800-171 Readiness Checklist
Check how you protect Controlled Unclassified Information (CUI) and get ready to report your Supplier Performance Risk System (SPRS) score.
Get the checklist : NIST SP 800-171 Readiness Checklist -
NIST New
NIST AI RMF Readiness Checklist
Check your AI risk practices against the four AI Risk Management Framework (AI RMF) functions: Govern, Map, Measure and Manage.
Get the checklist : NIST AI RMF Readiness Checklist -
CMMC New
CMMC 2.0 Readiness Checklist
What still applies now that Phase II is suspended, and how to stay ready.
Get the checklist : CMMC 2.0 Readiness Checklist
Interactive tools
Answer a few questions or check the dates that affect you.
-
All frameworks
Compliance Readiness Quiz
Six questions, one honest recommendation on where to start.
Take the quiz : Compliance Readiness Quiz -
All frameworks
Compliance Deadlines Calendar
Upcoming dates for the EU AI Act, NIS 2, CMMC, NIST and more, with the date each was last checked.
See the dates : Compliance Deadlines Calendar
Learn the standards
Plain-language overviews of the management-system standards behind our readiness work.
-
ISO 27001
What is ISO 27001?
A clear overview of the information security management standard.
Read the overview : What is ISO 27001? -
ISO 42001
What is ISO 42001?
A clear overview of the AI management system standard.
Read the overview : What is ISO 42001?
No tools match that framework yet.
When a checklist isn't enough
The ISO 27001 readiness pack
Policies, procedures, a gap analysis workbook and a risk register, written for the teams who will actually use them. Written to support your preparation for a Stage 1 audit.
View the packQuestions
Are these tools really free?
Yes. The quiz, calendar and explainers are open to everyone. Each readiness checklist asks for your work email and a few details about you and your company, then opens on the page straight away. Emails about new templates and our newsletter are optional and separate: tick a box only if you want them, and we will ask you to confirm your email address first. You can unsubscribe at any time, and unsubscribing never requires a login.
Who are these resources for?
GRC teams, operations leaders, executive teams, technology teams and consultants who want to know where they stand before committing time or budget. Use the role buttons above to see the most relevant tools first.
How does the readiness quiz work?
You answer six questions about your organization, where you operate and what you are being asked for. The quiz recommends one place to start, such as a specific checklist or readiness pack.
Will a checklist make us compliant?
No checklist can do that on its own. These are readiness aids that show where your gaps are. They are general guidance, not legal advice, and they do not know your specific systems or environment.
How current is the content?
Each checklist shows the date it was last reviewed and lists the sources it relies on. Deadlines that have been suspended or are still proposals, such as CMMC Phase II and the proposed SOC 2 attestation standards, are marked as such rather than shown as fixed dates.
Prefer to talk it through with a person?
Book a free consult