Security policies and evidence requests

Browse security policies, procedures and evidence requests for access control, incidents, cryptography and suppliers.

Set security controls, review access and suppliers, prepare for incidents, and collect evidence of how controls operate.

Open Security templates in Sorena AI to search these titles and read the current template. The in-app catalog shows available revisions and withdrawn records. This title reference was reviewed on 27 October 2026.

The kind column identifies the starting content each entry creates. Review and adapt documents before use. Evidence requests describe records your organization needs to supply. See template kinds if you need help choosing between a document, evidence folder, and timeline.

Acceptable use

Template title	Kind
Acceptable use policy	Policy
CUI rules of behavior acknowledgement register	Register

Access control

Template title	Kind
Access control policy	Policy
Access control standard	Standard
User access lifecycle procedure	Procedure
Access review procedure	Procedure
Access control guidance	Guideline
Access permission register	Register
Access control evidence package	Evidence folder
Privileged administration device and route procedure	Procedure

Audit testing protection

Template title	Kind
Audit and security testing procedure	Procedure
Audit testing plan	Plan
Audit testing contract terms standard	Standard
Audit testing agreement register	Register
Audit testing safeguards evidence package	Evidence folder

Business continuity

Template title	Kind
Security during disruption procedure	Procedure

California consumer privacy

Template title	Kind
California cybersecurity audit report register	Register
California cybersecurity audit certification register	Register
California cybersecurity audit procedure	Procedure

Cloud security

Template title	Kind
Cloud services security policy	Policy
Cloud security standard	Standard
Cloud service security plan	Plan

Communication

Template title	Kind
Specialist security community engagement procedure	Procedure

Covert channel analysis and bandwidth estimates

Template title	Kind
Covert channel analysis procedure	Procedure

Cryptographic protection

Template title	Kind
Encryption configuration evidence package	Evidence folder
Cryptography policy	Policy
Cryptography standard	Standard
Key management procedure	Procedure
Cryptographic inventory	Register
Cryptographic improvement plan	Plan

Controlled unclassified information protection

CUI means controlled unclassified information.

Template title	Kind
CUI system security plan	Plan
CUI organization-defined parameters register	Register
CUI plans of action and milestones	Register

Information classification

Template title	Kind
Information classification evidence package	Evidence folder
Information classification policy	Policy
Information classification standard	Standard
Information classification procedure	Procedure
Information classification guidance	Guideline
Information classification register	Register

Data loss and leakage prevention

Template title	Kind
Data leakage prevention evidence package	Evidence folder
Information leakage prevention policy	Policy
Data loss prevention standard	Standard
Data leakage alert handling procedure	Procedure
Information fragmentation procedure	Procedure

Digital operational resilience for financial entities

DORA is the EU Digital Operational Resilience Act. ICT means information and communication technology; TLPT means threat-led penetration testing.

Template title	Kind
ICT risk management framework plan	Plan
ICT risk framework review register	Register
DORA register of information	Register
Threat-led penetration test plan	Plan
TLPT remediation and authority attestation register	Register
DORA ICT contractual terms standard	Standard
Critical ICT third-party provider oversight procedure	Procedure

Endpoint security

Template title	Kind
Personally owned and mobile device policy	Policy
Endpoint security standard	Standard
Malware detonation procedure	Procedure
Endpoint protection and device decision register	Register

Information security incident management

Template title	Kind
Incident management evidence package	Evidence folder
Information security incident management policy	Policy
Incident classification and management standard	Standard
Incident response procedure	Procedure
Incident magnitude validation procedure	Procedure
Incident management guidance	Guideline
Incident readiness and response plan	Plan
Incident register	Register

Secure transfer of information

Template title	Kind
Information transfer policy	Policy
Information transfer standard	Standard
Information transfer procedure	Procedure
Information transfer guidance	Guideline
Information transfer agreements register	Register

Event logs and activity monitoring

Template title	Kind
Logging and monitoring evidence request	Evidence folder
Logging and monitoring standard	Standard
Sensor relocation procedure	Procedure
Event correlation procedure	Procedure
Logging and monitoring guidance	Guideline

Mission resource intended purpose reviews

Template title	Kind
Mission resource intended purpose review procedure	Procedure

Network protection

Template title	Kind
Network security evidence request	Evidence folder
Network security policy	Policy
Network security standard	Standard
Cyber deception procedure	Procedure
Network security guidance	Guideline

Operational technology and industrial control security

OT means operational technology, including equipment used to monitor or control physical processes.

Template title	Kind
OT and industrial control security standard	Standard
OT security work and recovery procedure	Procedure
OT security decisions and work register	Register
OT security operating evidence request	Evidence folder

Physical security

Template title	Kind
Physical security evidence request	Evidence folder
Physical security practice guide	Guideline
Physical security improvement plan	Plan
Clear desk and screen locking policy	Policy
Physical security policy	Policy
Physical access and facility protection procedure	Procedure
Physical security assessment procedure	Procedure
Secure areas and physical security zones register	Register
Physical security standard	Standard
Cabling security standard	Standard
Electromagnetic pulse protection standard	Standard
Physical security assessment results register	Register

Resilient system architecture

Template title	Kind
Resilient specialization, portability and technology-diversity plan	Plan

Secure software development

Template title	Kind
Security domain isolation standard	Standard
Secure development contract terms standard	Standard
Secure development agreements register	Register

Security and privacy control assessment

Template title	Kind
Security and privacy assessment plan	Plan
Security and privacy assessment procedure	Procedure
Security and privacy assessment results register	Register
Security and privacy assessment report register	Register

Template title	Kind
Social media account security procedure	Procedure
Social media accounts and access register	Register
Social media account security evidence package	Evidence folder

Supplier and external provider management

Template title	Kind
Supplier selection, control and performance evidence	Evidence folder
Supplier relationships policy	Policy
Supplier management standard	Standard
Supplier management procedure	Procedure
Supplier oversight plan	Plan
Supplier assurance guidance	Guideline
Supplier register	Register
Supplier contract terms standard	Standard
Supplier agreements register	Register
Supplier management assessment procedure	Procedure
Supplier management assessment results register	Register

System description and service commitments

Template title	Kind
Management assertion register	Register
Customer security notice guidance	Guideline

Vulnerability and patch management

Template title	Kind
Vulnerability scanning, testing and remediation evidence	Evidence folder
Vulnerability management standard	Standard
Vulnerability management procedure	Procedure
Vulnerability register	Register

Zero trust architecture and transition

Template title	Kind
Zero trust architecture and transition plan	Plan
Zero trust architecture decisions register	Register

Create content from a catalog entry

Open the relevant requirement in your management system, review its expected content, and choose an eligible destination project. Follow Create IMS documents and evidence folders for creation, reuse, and preview steps. Read the catalog guide for framework coverage and the other organizational domains.

Screenshots show a demo workspace.

Security policies and evidence requests

Acceptable useCopy Anchor Link

Access controlCopy Anchor Link

Audit testing protectionCopy Anchor Link

Business continuityCopy Anchor Link

California consumer privacyCopy Anchor Link

Cloud securityCopy Anchor Link

CommunicationCopy Anchor Link

Covert channel analysis and bandwidth estimatesCopy Anchor Link

Cryptographic protectionCopy Anchor Link

Controlled unclassified information protectionCopy Anchor Link

Information classificationCopy Anchor Link

Data loss and leakage preventionCopy Anchor Link

Digital operational resilience for financial entitiesCopy Anchor Link

Endpoint securityCopy Anchor Link

Information security incident managementCopy Anchor Link

Secure transfer of informationCopy Anchor Link

Event logs and activity monitoringCopy Anchor Link

Mission resource intended purpose reviewsCopy Anchor Link

Network protectionCopy Anchor Link

Operational technology and industrial control securityCopy Anchor Link

Physical securityCopy Anchor Link

Resilient system architectureCopy Anchor Link

Secure software developmentCopy Anchor Link

Security and privacy control assessmentCopy Anchor Link

Social media account securityCopy Anchor Link

Supplier and external provider managementCopy Anchor Link

System description and service commitmentsCopy Anchor Link

Vulnerability and patch managementCopy Anchor Link

Zero trust architecture and transitionCopy Anchor Link

Create content from a catalog entryCopy Anchor Link

On this page