Resources · Templates

Templates for GRC teams

Reusable policy, questionnaire, and evidence structures for busy teams.

Vendor risk tiering template

A simple tiering model to decide which vendors need fast review, deep review, or ongoing monitoring.

A reusable structure for answering common buyer diligence questions with less copy-paste effort.

A simple way to track each control, its evidence source, owner, and review cadence before fieldwork starts.

A practical set of privacy-focused questions to ask subprocessors before approving them.

A lightweight way to document which Annex A controls apply, why they apply, and how they are implemented.

A practical structure for records of processing activities that product and compliance teams can maintain together.

A review structure for third parties that can create, receive, maintain, or transmit PHI on your behalf.

A simple framework for deciding what belongs in your trust center, what should be gated, and what should stay internal.

A lightweight template for capturing auditor requests, owners, due dates, and evidence status in one place.