Every item below is a document or session you keep. E = included in Essentials ($2,500 USD). C = included in Complete ($5,000 USD). Items marked E are also in Complete.
A spreadsheet of your systems, SaaS accounts, devices and suppliers, who owns each, and what data each holds. Personal information is tagged, with where it is stored, who can reach it, and how long it is kept. This is the document most questionnaires and every breach response depends on.
Your top risks (for example: phishing of a staff mailbox, ransomware on a file server, a lost laptop, a supplier breach), each rated by likelihood and impact, with an owner and the fix. Complete adds a fuller register tied to NIST CSF 2.0 categories.
A prioritized action list: what to do in the first 30, 60 and 90 days, who does it, rough effort, and what you gain. Typical first items: MFA on email and admin accounts, tested offline backups, patching, password manager, encryption on laptops.
Short, plain-language policies written for your business, not generic legalese. Each has a purpose, scope, rules, owner, review date and a one-line version for staff.
| Policy | What it covers |
|---|---|
| Information Security Policy | Governance: who is accountable, how risks are reviewed, annual review, how exceptions are approved. |
| Acceptable Use | Devices, email, internet, personal devices, remote work, reporting of suspicious messages. |
| Access Control, Passwords & MFA | Unique accounts, least privilege, multifactor authentication, password length and a password manager, joiner/mover/leaver steps with same-day removal, quarterly access review. |
| Data Classification & Retention | What counts as personal, confidential or public information, how each is stored, and how long it is kept before secure deletion. |
| Backup & Recovery | What is backed up, offline or immutable copies, restore testing schedule, recovery priorities and target times. |
| Vendor & Supplier Management | What to check before sharing data with a supplier, contract security clauses, annual review, offboarding. |
| AI Use Policy | Which AI tools are approved, what data must never be entered into public AI tools, human review of AI output, and record-keeping. |
| Incident Response Policy | Short policy that points to the Incident Response Plan below and sets reporting duties for every staff member. |
A working document you can open in a crisis. It follows the standard phases (preparation, identification, containment, eradication, recovery, lessons learned) and includes:
Templates follow public regulator guidance. They are not legal advice; have counsel review before use.
A 2-hour facilitated walk-through of a realistic scenario (for example ransomware on a Monday morning) with your key people. You get a written after-action report: what worked, gaps, and fixes added to the roadmap. Annual repeat is recommended by most frameworks.
A reusable library of accurate answers to the questions SIG-style and CAIQ-style questionnaires ask most (access, encryption, incident response, vendors, business continuity). We complete up to two of your real questionnaires with you, using only controls you have.
Written answers for Amazon’s Solution Provider application and Data Protection Policy: incident response plan (including 24-hour notice to Amazon), data retention, encryption, credential management and network protection, with a checklist of controls Amazon expects, so you can see what is in place and what is not.
Your current practices mapped across Govern, Identify, Protect, Detect, Respond and Recover, with the gaps highlighted and prioritized in the roadmap.
A review of up to 10 suppliers that hold your data: what they hold, what security evidence they publish, contract points to request, and a risk rating.
If you accept cards: how your payment flow is set up, which self-assessment questionnaire likely applies, and how to shrink scope (for example by using a hosted payment page). Not a QSA assessment.
A table of the controls auditors typically ask for, marked in place, partial or missing for your company, with a realistic view of effort. Not an audit.
The controls insurers commonly ask about (MFA, backups, endpoint protection, incident plan, training, patching), with what you can truthfully answer today and what to fix before renewal.
Tell us your company size, the tools you use, and what prompted the request (a customer questionnaire, an insurer, an Amazon application, or just wanting a plan). We reply with a short scoping note and a written confirmation of price and scope before any work starts.
Email sales@abdouexpress.com Masks.Health - Original Medical Masks Made Before COVID-19 contact form WestNet contact · 403-774-7470
Masks.Health - Original Medical Masks Made Before COVID-19 · Calgary, Alberta, Canada. Independent service provider. Related: CyberSecurity by WestNet · WestNet VPN · Amazon Services · Computer Repair · Customer Satisfaction.
