Skip to content

Free compliance templates

Free compliance templates and checklists

Six files for the documents small teams get asked for most: a HIPAA authorization form, a BAA review checklist, a SOC 2 policy list, a CMMC SSP outline, a vendor risk questionnaire and an ISO 27001 checklist. No email required. Review every legal template with counsel before use.

Take the 3-minute Cyber Hygiene Test
Six free filesNo email gateReview with counsel before use

The templates

Download, adapt, then have counsel read it.

Review with counsel before use. These are starting points, not legal advice. Laws change and vary by state, and a template only works once it describes how your company actually operates.

HIPAA authorization form (release of PHI)

A patient authorization to use or disclose protected health information, with the six core elements and three required statements of 45 CFR 164.508(c), and a checklist for the practice. What is PHI?

Review with counsel before use.

FreeMarkdown

HIPAA BAA review checklist

Every clause 45 CFR 164.504(e) and 164.314(a) require in a business associate agreement, with a column to note where each sits in the vendor’s contract, plus the terms worth adding. The BAA clause checklist, explained

Review with counsel before use.

FreeMarkdown

SOC 2 policy list

The policies auditors commonly expect at a small company, each mapped to the Trust Services Criteria groups, with columns for the owner, approval date and next review. SOC 2 compliance checklist

Review with counsel before use.

FreeMarkdown

CMMC Level 2 SSP outline

A System Security Plan structure for NIST SP 800-171 Revision 2: identification, boundary and data flows, the five asset categories, the 14 requirement families and the POA&M reference. CMMC compliance checklist

Review with counsel before use.

FreeMarkdown

Vendor risk assessment questionnaire

31 questions across eleven areas, from encryption and incident notification to subprocessors and AI use, with a reviewer decision at the end. The spreadsheet has columns for answers, evidence and a risk rating. Do I need a BAA with this vendor?

Review with counsel before use.

FreeMarkdown, Spreadsheet (CSV)

ISO 27001 checklist (2022 version)

Seven steps from leadership sign-off to Stage 2, each item with its clause and the proof to keep, plus all 93 Annex A controls for your Statement of Applicability. The ISO 27001 checklist, step by step

Review with counsel before use.

FreePDF, Spreadsheet (CSV)

Vendor risk

A vendor risk assessment, without buying a tool first

SOC 2 and ISO 27001 both expect you to review the vendors that handle your data, and HIPAA requires a business associate agreement with each one that touches PHI. The questionnaire above covers the security side. Send it before you sign, keep the answers and the vendor’s SOC 2 report or ISO certificate with your inventory, and repeat it yearly for the vendors that matter most.

For HIPAA customers, the business associate inventory in our HIPAA compliance software keeps each agreement, owner and renewal date, with a reminder before one lapses. The wider controls are in the SOC 2 compliance checklist and the HIPAA compliance checklist, and terms such as subprocessor and DDQ are in our compliance glossary.

Questions about the templates and vendor risk

Are these templates free?
Yes. Every file downloads directly, with no email or form in the way. They are Markdown, CSV and PDF files, so they open in any editor, Excel, Google Sheets or Word.
Can we use these templates as they are?
Use them as a starting point, not a finished document. Each one says on its first line to review it with counsel before use. The HIPAA authorization form in particular has state-law variations, and every policy and plan has to describe how your company actually works.
What is vendor risk management software?
Software that keeps your vendor inventory, sends security questionnaires, stores the answers with each vendor’s SOC 2 report or certificate, rates the risk and reminds you when a review or a contract is due. Larger programs add continuous monitoring of vendors’ external security. A small company can run the same process with a questionnaire like ours and a spreadsheet until the vendor list outgrows it.
What should vendor risk management tools do at minimum?
Hold one list of vendors with an owner and a risk tier, send a questionnaire, store the evidence, record a decision and set the next review date. SOC 2 (CC9) and ISO 27001 (A.5.19 to A.5.22) test that the reviews happened and were kept, not which tool ran them.
What is the difference between vendor risk and third-party risk management?
They are mostly used as the same thing. Third-party risk management is the broader term and can include partners, resellers and subprocessors as well as vendors you pay. The questionnaire works for any of them.
Which vendors need the full questionnaire?
The ones that will store, process or reach sensitive data: patient records, CUI, customer data, payment data or your production systems. For low-risk vendors, the first three sections are usually enough.

Next step

Rather have an engineer fill them in with you?

Book thirty minutes and leave with the frameworks that apply to you, the documents you are missing and a fixed fee in writing. Or start with the free Cyber Hygiene Test.

Take the 3-minute Cyber Hygiene Test

See how we use your information

The regulator has the final say. We help interpret, scope and get you ready; we do not certify.

3-min test