{"title":"Compliance Templates","description":"\u003cp\u003eReady-to-use GRC and compliance template packs from Zee Consulting — built by practicing consultants, mapped to the frameworks auditors actually use.\u003c\/p\u003e","products":[{"product_id":"vendor-security-assessment-pack-50-question-nist-mapped-questionnaire-excel-guide","title":"Vendor Security Assessment Pack — 50-Question NIST-Mapped Questionnaire (Excel + Guide)","description":"\u003cp\u003e\u003cstrong\u003eAssess any vendor's security in one sitting — without building the questionnaire yourself.\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eThe Vendor Security Assessment Pack gives you a complete, ready-to-send third-party security questionnaire: \u003cstrong\u003e50 questions across 10 sections\u003c\/strong\u003e, covering governance, access control, data protection, network security, logging \u0026amp; monitoring, incident response, business continuity, physical security, personnel security, and compliance \u0026amp; audit.\u003c\/p\u003e\n\u003cp\u003eEvery question is mapped to the frameworks your auditors and customers actually use:\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNIST SP 800-53 Rev. 5\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eISO\/IEC 27001:2022 Annex A\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eSOC 2 Trust Services Criteria\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePCI DSS v4.0.1\u003c\/strong\u003e (only where the requirement genuinely applies)\u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eNIST CSF 2.0\u003c\/strong\u003e\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eIt scores itself.\u003c\/strong\u003e Vendors answer Yes \/ Partial \/ No \/ N\/A. Critical questions carry double weight, N\/A answers are excluded fairly, and the Score Summary tab produces a weighted score, a suggested risk tier (Low \/ Medium \/ High \/ Critical), and a per-section breakdown that shows exactly where a vendor is weakest.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eReviewer guidance is built in.\u003c\/strong\u003e Each question includes a \"What good looks like\" note — the specific evidence a strong answer should produce — so reviews stay consistent no matter who runs them.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's inside\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor_Security_Assessment_Workbook.xlsx\u003c\/strong\u003e — instructions, the full 50-question assessment with response dropdowns and automatic scoring, and the Score Summary dashboard.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor_Security_Assessment_Guide.docx\u003c\/strong\u003e — a step-by-step administrator guide: how to run an assessment, how scoring and tiers work, and reviewer tips.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e companies onboarding SaaS, cloud, or IT vendors that need a defensible security review; security \u0026amp; compliance leads building a third-party risk management (TPRM) process; consultants who need a client-ready questionnaire today, not next month.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eLicense:\u003c\/strong\u003e single-organization license — use the pack for your own vendor assessments, unlimited times. Templates support your security program; they are not legal or audit advice and do not guarantee any audit outcome.\u003c\/p\u003e\n\u003cp\u003e\u003cem\u003eWritten and maintained by practicing consultants at Zee Consulting.\u003c\/em\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence.\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. The materials in this product are the intellectual property of Zee Consulting. Your purchase grants a single organization a non-exclusive, non-transferable licence to use and customize them for its own internal business purposes. They may not be resold, redistributed, shared, published, or provided to any other organization, in whole or in part, in original or modified form. Unauthorized use constitutes copyright infringement and breach of licence, and may result in litigation and liability for damages and legal costs. Full terms are included in the download (Copyright_and_Licence_Terms.docx).\u003c\/p\u003e","brand":"Zee Consulting","offers":[{"title":"Default Title","offer_id":67819519869115,"sku":"ZEE-VSA-001","price":149.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/vendor-security-assessment-pack-cover.png?v=1792678895"},{"product_id":"iso-27001-soc-2-policy-pack-15-audit-ready-policy-templates-word-excel","title":"ISO 27001 + SOC 2 Policy Pack — 15 Audit-Ready Policy Templates (Word + Excel)","description":"\u003cp\u003e\u003cstrong\u003eThe policy layer for ISO 27001 and SOC 2 — written once, mapped to both.\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003eAuditors for both frameworks ask for the same thing first: your documented policies. This pack gives you \u003cstrong\u003e15 complete, professionally formatted policy templates\u003c\/strong\u003e, each mapped to \u003cstrong\u003eISO\/IEC 27001:2022 Annex A\u003c\/strong\u003e and the \u003cstrong\u003eSOC 2 Trust Services Criteria\u003c\/strong\u003e — one policy set serving both audits.\u003c\/p\u003e\n\u003cp\u003eEvery policy follows the same audit-friendly structure: purpose, scope, numbered policy statements, roles \u0026amp; responsibilities, enforcement and exceptions, review cycle, a document-control table, the framework mapping table, and a signature approval block.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eThe 15 policies:\u003c\/strong\u003e Information Security · Access Control · Acceptable Use · Password \u0026amp; Authentication · Asset Management · Data Classification \u0026amp; Handling · Encryption · Incident Response · Change Management · Risk Management · Vendor \u0026amp; Supplier · Human Resources Security · Backup \u0026amp; Business Continuity · Logging \u0026amp; Monitoring · Secure Development.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's inside:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e15 fully editable policy documents (.docx) with [bracketed] placeholders where your details go\u003c\/li\u003e\n\u003cli\u003eImplementation Guide (.docx) — how to customize, approve, publish, and evidence the pack\u003c\/li\u003e\n\u003cli\u003ePolicy Crosswalk \u0026amp; Checklist (.xlsx) — the auditor-facing control map plus a rollout and recurring-cadence checklist\u003c\/li\u003e\n\u003cli\u003eDelivered as one ZIP; files are also usable individually\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e companies preparing for a first SOC 2 or ISO 27001 audit; security \u0026amp; compliance leads replacing scattered, outdated policies; consultants who need a client-ready dual-framework policy library.\u003c\/p\u003e\n\u003cp\u003e\u003cem\u003ePlease note: templates provide the documented policy framework; certification and attestation also require operating the controls and an independent audit.\u003c\/em\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eLicense:\u003c\/strong\u003e single organization — customize, brand, and distribute internally. Resale or external redistribution is not permitted.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence.\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. The materials in this product are the intellectual property of Zee Consulting. Your purchase grants a single organization a non-exclusive, non-transferable licence to use and customize them for its own internal business purposes. They may not be resold, redistributed, shared, published, or provided to any other organization, in whole or in part, in original or modified form. Unauthorized use constitutes copyright infringement and breach of licence, and may result in litigation and liability for damages and legal costs. Full terms are included in the download (Copyright_and_Licence_Terms.docx).\u003c\/p\u003e","brand":"Zee Consulting","offers":[{"title":"Default Title","offer_id":67825881841851,"sku":"ZEE-POL-002","price":199.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/iso-soc2-policy-pack-cover.png?v=1792684402"},{"product_id":"canadian-msb-aml-starter-kit-complete-fintrac-compliance-program-word-excel","title":"Canadian MSB AML Starter Kit — Complete FINTRAC Compliance Program (Word + Excel)","description":"\u003cp\u003eRegistering a money services business with FINTRAC — or already registered and facing your first examination? FINTRAC requires every Canadian MSB to run a documented AML\/ATF compliance program: an appointed compliance officer, written policies and procedures, a risk assessment, a training program, and a two-year effectiveness review. This kit is that program, written out in full — 18 branded, fully editable templates built around the PCMLTFA.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (18 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAML\/ATF Compliance Program Manual — the master program document\u003c\/li\u003e\n\u003cli\u003eCompliance Officer Appointment Pack — appointment record, role charter, annual attestation\u003c\/li\u003e\n\u003cli\u003eEffectiveness Review Guide — the required two-year review, structured end to end\u003c\/li\u003e\n\u003cli\u003eKYC\/CDD Procedures — ID verification methods, beneficial ownership, risk ratings, enhanced measures\u003c\/li\u003e\n\u003cli\u003ePEP\/HIO \u0026amp; Sanctions Screening Procedure\u003c\/li\u003e\n\u003cli\u003eTransaction Monitoring Procedure — scenarios, red flags, alert and case handling\u003c\/li\u003e\n\u003cli\u003eSTR Reporting Procedure — escalation to filing, deadlines, confidentiality\u003c\/li\u003e\n\u003cli\u003eLarge Cash \u0026amp; EFT Reporting Procedure — LCTR\/EFTR, the 24-hour rule, the travel rule\u003c\/li\u003e\n\u003cli\u003eVirtual Currency Procedure — LVCTR, travel rule, wallet screening\u003c\/li\u003e\n\u003cli\u003eRecord-Keeping Procedure — the five-year retention standard\u003c\/li\u003e\n\u003cli\u003eIndividual KYC \u0026amp; Risk Rating Form (Word)\u003c\/li\u003e\n\u003cli\u003eCorporate Client \u0026amp; Beneficial Ownership Form (Word)\u003c\/li\u003e\n\u003cli\u003eStaff AML Training Program — the written plan FINTRAC requires\u003c\/li\u003e\n\u003cli\u003eML\/TF Red Flags Quick Reference\u003c\/li\u003e\n\u003cli\u003eAML Risk Assessment Workbook (Excel) — 17 risk factors, automatic inherent\/residual scoring\u003c\/li\u003e\n\u003cli\u003eReporting \u0026amp; Compliance Registers (Excel) — STR, LCTR\/EFTR\/LVCTR, ID verification, and training logs with due-date helpers\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003cli\u003eStart Here Implementation Guide\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Canadian money services businesses — money transmitters, foreign exchange dealers, virtual currency dealers, and agents — that need a complete, defensible compliance program without paying consulting rates to draft one from a blank page.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Download the ZIP, replace the [BRACKETED] placeholders with your organization's details, have senior management approve the manual, and follow the Start Here guide's implementation order. Every document carries professional formatting: document control, approval blocks, and review cycles built in.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice. AML obligations vary by registration category, products, and province; confirm thresholds and deadlines against current FINTRAC guidance and have your program reviewed by qualified counsel before relying on it.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e\n","brand":"Zee Consulting","offers":[{"title":"Default","offer_id":67827397558459,"sku":"ZEE-MSB-003","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/canadian-msb-aml-kit-cover.png?v=1792687216"},{"product_id":"us-msb-aml-starter-kit-complete-bsa-compliance-program-word-excel","title":"US MSB AML Starter Kit — Complete BSA Compliance Program (Word + Excel)","description":"\u003cp\u003eEvery U.S. money services business must run a written, risk-based AML program under the Bank Secrecy Act (31 CFR 1022.210) — and FinCEN registration is only the first step. This kit is the program, written out in full: 18 branded, fully editable templates covering the program manual, compliance officer pack, customer identification and due diligence, OFAC screening, transaction monitoring, SAR and CTR reporting with the real deadlines and thresholds, the travel rule, virtual currency obligations, recordkeeping, a scored risk assessment workbook, the registers examiners test, customer forms, a training program, and a Start Here implementation guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (18 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eBSA\/AML Compliance Program Manual — the master program document (31 CFR 1022.210)\u003c\/li\u003e\n\u003cli\u003eCompliance Officer Appointment Pack — appointment record, role charter, annual attestation\u003c\/li\u003e\n\u003cli\u003eIndependent Review Guide — the required independent review, structured end to end\u003c\/li\u003e\n\u003cli\u003eCustomer Identification \u0026amp; Due Diligence Procedures — BSA ID triggers, risk ratings, enhanced due diligence\u003c\/li\u003e\n\u003cli\u003eOFAC \u0026amp; Sanctions Screening Procedure — SDN screening, blocked vs rejected handling, 10-day reports\u003c\/li\u003e\n\u003cli\u003eTransaction Monitoring Procedure — scenarios, red flags, alert and case handling\u003c\/li\u003e\n\u003cli\u003eSAR Reporting Procedure — $2,000 threshold, 30-day deadline, SAR confidentiality\u003c\/li\u003e\n\u003cli\u003eCTR \u0026amp; Currency Reporting Procedure — currency over $10,000, aggregation, monetary instrument records, travel rule\u003c\/li\u003e\n\u003cli\u003eVirtual Currency Procedure — FinCEN CVC guidance, wallet screening\u003c\/li\u003e\n\u003cli\u003eRecordkeeping Procedure — the five-year retention standard\u003c\/li\u003e\n\u003cli\u003eIndividual Customer Information \u0026amp; Risk Rating Form (Word)\u003c\/li\u003e\n\u003cli\u003eBusiness Customer \u0026amp; Beneficial Ownership Form (Word)\u003c\/li\u003e\n\u003cli\u003eStaff AML Training Program — the written plan the BSA requires\u003c\/li\u003e\n\u003cli\u003eML\/TF Red Flags Quick Reference\u003c\/li\u003e\n\u003cli\u003eAML Risk Assessment Workbook (Excel) — 17 risk factors, automatic inherent\/residual scoring\u003c\/li\u003e\n\u003cli\u003eReporting \u0026amp; Compliance Registers (Excel) — SAR and CTR logs with due-date helpers, monetary instrument log, training log\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003cli\u003eStart Here Implementation Guide\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e U.S. money services businesses — money transmitters, currency exchangers, check cashers, money order issuers\/sellers, virtual currency exchangers, and their agents — that need a complete, defensible BSA program without paying consulting rates to draft one from a blank page.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Download the ZIP, replace the [BRACKETED] placeholders with your organization's details, have senior management approve the manual, and follow the Start Here guide's implementation order. Every document carries professional formatting: document control, approval blocks, and review cycles built in.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice. BSA obligations vary by MSB category, products, and states of operation; FinCEN registration does not replace state money transmitter licensing. Confirm thresholds and deadlines against current FinCEN guidance and have your program reviewed by qualified U.S. counsel before relying on it.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e\n","brand":"Zee Consulting","offers":[{"title":"Default","offer_id":67828168491195,"sku":"ZEE-MSB-004","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/us-msb-aml-kit-cover.png?v=1792688587"},{"product_id":"mortgage-financing-leasing-aml-starter-kit-fintrac-new-sectors-word-excel","title":"Canadian Mortgage, Financing \u0026 Leasing AML Starter Kit — FINTRAC New Sectors (Word + Excel)","description":"\u003cp\u003eMortgage brokers, lenders, and administrators became FINTRAC reporting entities on October 11, 2024 — and financing and leasing businesses (including car dealers that offer financing) on April 1, 2025. There's no registration to apply for: the PCMLTFA obligations simply apply, and most businesses in these sectors are building an AML program for the first time. This kit is that program, written for your sector — 18 branded, fully editable templates, from the compliance program manual through source-of-funds verification and the scored risk assessment workbook.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (18 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eAML\/ATF Compliance Program Manual — written for the mortgage and financing\/leasing sectors\u003c\/li\u003e\n\u003cli\u003eCompliance Officer Appointment Pack — appointment record, role charter, annual attestation\u003c\/li\u003e\n\u003cli\u003eEffectiveness Review Guide — the required two-year review, structured end to end\u003c\/li\u003e\n\u003cli\u003eKYC\/CDD Procedures — borrower\/lessee identification, beneficial ownership, risk ratings\u003c\/li\u003e\n\u003cli\u003ePEP\/HIO \u0026amp; Sanctions Screening Procedure\u003c\/li\u003e\n\u003cli\u003eTransaction Monitoring Procedure — origination and servicing-stage monitoring\u003c\/li\u003e\n\u003cli\u003eSTR Reporting Procedure — escalation to filing\u003c\/li\u003e\n\u003cli\u003eLarge Cash \u0026amp; EFT Reporting Procedure — LCTR\/EFTR and the 24-hour rule for funds you receive\u003c\/li\u003e\n\u003cli\u003eSource of Funds \u0026amp; Down Payment Verification Procedure — evidence standards by risk level, gift letters, third-party funds\u003c\/li\u003e\n\u003cli\u003eRecord-Keeping Procedure — the five-year retention standard\u003c\/li\u003e\n\u003cli\u003eMortgage Client KYC \u0026amp; Source of Funds Form (Word)\u003c\/li\u003e\n\u003cli\u003eFinancing \u0026amp; Leasing Client KYC Form (Word)\u003c\/li\u003e\n\u003cli\u003eStaff AML Training Program — including broker and dealer partners\u003c\/li\u003e\n\u003cli\u003eML\/TF Red Flags Quick Reference — sector typologies (straw buyers, third-party down payments, buyout patterns)\u003c\/li\u003e\n\u003cli\u003eAML Risk Assessment Workbook (Excel) — 17 sector risk factors, automatic inherent\/residual scoring\u003c\/li\u003e\n\u003cli\u003eReporting \u0026amp; Compliance Registers (Excel) — STR, LCTR\/EFTR, ID verification, and training logs with due-date helpers\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003cli\u003eStart Here Implementation Guide — including what \"new to FINTRAC\" actually requires\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Canadian mortgage brokers, mortgage lenders, mortgage administrators, financing companies, leasing companies, and dealers that arrange financing — any business brought under the PCMLTFA in the 2024–2025 sector expansion that needs a complete, practical AML program without paying consulting rates to draft one from a blank page.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Download the ZIP, replace the [BRACKETED] placeholders with your organization's details, have senior management approve the manual, and follow the Start Here guide's implementation order. Every document carries professional formatting: document control, approval blocks, and review cycles built in.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice. FINTRAC's guidance for these sectors is recent and evolving; confirm your category, thresholds, and deadlines against current FINTRAC guidance and have your program reviewed by qualified Canadian counsel before relying on it.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e\n","brand":"Zee Consulting","offers":[{"title":"Default","offer_id":67829748400315,"sku":"ZEE-MFL-005","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/mortgage-financing-leasing-cover.png?v=1792691879"},{"product_id":"cybersecurity-threat-risk-assessment-toolkit-nist-sp-800-30-iso-27005-word-excel","title":"Cybersecurity Threat \u0026 Risk Assessment Toolkit — NIST SP 800-30 \u0026 ISO 27005 (Word + Excel)","description":"\u003cp\u003eA complete, working threat and risk assessment system — not a blank register. The methodology follows NIST SP 800-30 Rev. 1 within the ISO\/IEC 27005 risk management process, with a threat catalogue, a vulnerability checklist, a 5×5 scoring workbook that calculates inherent and residual risk for you, a framework crosswalk for treatments, and an executive report template. Canada and U.S. annexes align the same assessment to HTRA\/ITSG-33 and to the NIST RMF\/CMMC — one toolkit, both markets.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eMethodology \u0026amp; framework mapping — everything this toolkit is built on and mapped to:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cp\u003e\u003cem\u003eCore methodology\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST SP 800-30 Rev. 1\u003c\/strong\u003e — Guide for Conducting Risk Assessments (the assessment spine)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 27005\u003c\/strong\u003e — information security risk management process\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST Cybersecurity Framework (CSF) 2.0\u003c\/strong\u003e — Govern (GV.RA) and Identify (ID.RA) framing\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eControl mapping for risk treatments (Framework Crosswalk workbook)\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eISO\/IEC 27001:2022 Annex A\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST SP 800-53\u003c\/strong\u003e (also serves as the ITSG-33 Annex A reference for most controls)\u003c\/li\u003e\n\u003cli\u003e\u003cstrong\u003eCIS Controls v8\u003c\/strong\u003e\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST CSF 2.0\u003c\/strong\u003e outcomes\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eCanada\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eHTRA\u003c\/strong\u003e — Government of Canada Harmonized Threat and Risk Assessment: terminology and phase alignment\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eITSG-33\u003c\/strong\u003e — IT Security Risk Management (Canadian Centre for Cyber Security): lifecycle and control catalogue alignment\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cem\u003eUnited States\u003c\/em\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST Risk Management Framework — SP 800-37 Rev. 2\u003c\/strong\u003e: lifecycle alignment\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCMMC 2.0 and NIST SP 800-171\u003c\/strong\u003e: requirement touchpoints for defense contractors, including POA\u0026amp;M\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Implementation Guide\u003c\/li\u003e\n\u003cli\u003eRisk Assessment Methodology Guide — the 800-30 method, likelihood\/impact scales, risk rules\u003c\/li\u003e\n\u003cli\u003eThreat Catalogue — adversarial, accidental, structural, and environmental threat events\u003c\/li\u003e\n\u003cli\u003eVulnerability Assessment Checklist — weakness areas mapped to the control frameworks\u003c\/li\u003e\n\u003cli\u003eCanada Annex — HTRA \u0026amp; ITSG-33 Alignment\u003c\/li\u003e\n\u003cli\u003eUS Annex — NIST RMF \u0026amp; CMMC Alignment\u003c\/li\u003e\n\u003cli\u003eRisk Assessment Workbook (Excel) — asset inventory, threat assessment, risk register with automatic 5×5 scoring, summary dashboard\u003c\/li\u003e\n\u003cli\u003eFramework Crosswalk \u0026amp; Treatment Plan (Excel) — 16 control areas mapped across ISO 27001, SP 800-53, CIS v8, and CSF 2.0\u003c\/li\u003e\n\u003cli\u003eAssessment Scope \u0026amp; Plan Form (Word)\u003c\/li\u003e\n\u003cli\u003eRisk Treatment \u0026amp; Acceptance Form (Word)\u003c\/li\u003e\n\u003cli\u003eExecutive Risk Report Template (Word)\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Security consultants, vCISOs, and internal IT\/security and risk teams in Canada and the U.S. who need to run defensible, repeatable threat and risk assessments — for ISO 27001 programs, client engagements, public-sector HTRA-style deliverables, or CMMC readiness — without building the machinery from scratch.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Scope the assessment on the Scope \u0026amp; Plan form, inventory the assets, select threat events from the catalogue, examine vulnerabilities with the checklist, and score in the register — likelihood and impact dropdowns drive automatic 5×5 scores and levels for both inherent and residual risk. Map treatments in the crosswalk, record acceptances on the signed form, and report with the executive template.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not a certification, audit, or guarantee of compliance with any framework named. Framework names describe the mappings provided. Confirm framework editions and client-specific requirements at the start of each engagement.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e\n","brand":"Zee Consulting","offers":[{"title":"Default","offer_id":67831375429819,"sku":"ZEE-TRA-006","price":249.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/cyber-tra-toolkit-cover.png?v=1792694979"},{"product_id":"pci-dss-v4-0-1-readiness-pack-302-control-assessment-workbook-saq-guide-procedures-word-excel","title":"PCI DSS v4.0.1 Readiness Pack — 302-Control Assessment Workbook, SAQ Guide \u0026 Procedures (Word + Excel)","description":"\u003cp\u003eA complete readiness system for PCI DSS v4.0.1 — the current version of the standard — built for merchants and service providers who need to get assessment-ready without starting from a blank page. A scoping method, an SAQ selection guide, the core procedures assessors expect, and two workbooks that track all 302 requirements and sub-requirements plus every recurring compliance task.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eBuilt to the current standard:\u003c\/strong\u003e PCI DSS v4.0.1 (v4.0 retired 31 Dec 2024; v3.2.1 retired 31 Mar 2024). Every requirement is in force — including the formerly future-dated controls mandatory since 31 March 2025, such as payment-page script security (6.4.3), tamper detection (11.6.1), and expanded MFA.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (15 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the roadmap and how the pieces fit together\u003c\/li\u003e\n\u003cli\u003ePCI DSS Readiness \u0026amp; Scoping Guide — validation path, defining the CDE, segmentation, the prioritized approach, evidence discipline\u003c\/li\u003e\n\u003cli\u003eSAQ Selection Guide — SAQ A, A-EP, B, B-IP, C, C-VT, D and P2PE: who qualifies, and the mistakes that invalidate a self-assessment\u003c\/li\u003e\n\u003cli\u003eCDE Scoping \u0026amp; Segmentation Worksheet (Word form)\u003c\/li\u003e\n\u003cli\u003eTargeted Risk Analysis Template (Word form) — for the requirements that demand a documented TRA\u003c\/li\u003e\n\u003cli\u003eIncident Response Plan Template — Requirement 12.10, including the PAN-found trigger\u003c\/li\u003e\n\u003cli\u003eVulnerability \u0026amp; Patch Management Procedure — Requirements 6.3 \u0026amp; 11.3 (one-month rule for critical\/high patches, ASV scanning)\u003c\/li\u003e\n\u003cli\u003eAccess Control \u0026amp; Authentication Procedure — Requirements 7 \u0026amp; 8 (least privilege, 12-character passwords, MFA)\u003c\/li\u003e\n\u003cli\u003eLogging \u0026amp; Monitoring Procedure — Requirement 10 (12-month retention, daily review)\u003c\/li\u003e\n\u003cli\u003eEncryption \u0026amp; Key Management Procedure — Requirements 3 \u0026amp; 4 (stored PAN, TLS, full key lifecycle)\u003c\/li\u003e\n\u003cli\u003eService Provider Management Procedure — Requirement 12.8 (agreements, responsibility matrix, AoC monitoring)\u003c\/li\u003e\n\u003cli\u003eE-Commerce Payment Page Security Procedure — Requirements 6.4.3 \u0026amp; 11.6.1\u003c\/li\u003e\n\u003cli\u003eReadiness Assessment Workbook (Excel) — all 302 requirements \u0026amp; sub-requirements, status dropdowns, evidence and owner fields, readiness dashboard by requirement\u003c\/li\u003e\n\u003cli\u003eCompliance Registers (Excel) — remediation tracker with days-open counter, evidence register, service provider register, periodic tasks \u0026amp; testing calendar with the standard's frequencies pre-loaded\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Merchants preparing an SAQ or a QSA-led RoC, service providers validating under SAQ D, and the consultants, IT leads, and compliance managers who run PCI as a year-round program.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eHow it works:\u003c\/strong\u003e Settle scope first with the guide and worksheet, confirm your SAQ, then work the 302-control checklist — every gap lands in the remediation tracker with an owner and date, the procedures give you the documented controls assessors ask for, and the periodic-tasks calendar keeps quarterly scans and annual tests from ever surprising you.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not a certification, audit, or guarantee of compliance. Checklist summaries are plain-language readiness aids — assess against the official PCI DSS v4.0.1 document, available free from the PCI Security Standards Council.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting","offers":[{"title":"Default Title","offer_id":67832463327419,"sku":"ZEE-PCI-007","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/pci-dss-readiness-pack-cover.png?v=1792697612"},{"product_id":"ai-governance-risk-assessment-toolkit-iso-42001-nist-ai-rmf-mitre-atlas-owasp-word-excel","title":"AI Governance \u0026 Risk Assessment Toolkit — ISO 42001, NIST AI RMF, MITRE ATLAS, OWASP (Word + Excel)","description":"\u003cp\u003eThe complete system for governing AI and proving it — governance, risk assessment, impact assessment, security, fairness, and the technical test tooling to verify controls actually work. Built on the frameworks assessors, auditors, and regulators use, and covering every type of AI: generative AI and LLM applications, autonomous agents, RAG systems, classical machine learning, computer vision, speech, and recommenders.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eFramework stack:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 42001:2023\u003c\/strong\u003e — the AI management system: clauses 4–10 and all 38 Annex A controls\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 42005:2025\u003c\/strong\u003e — AI system impact assessment, with \u003cstrong\u003eISO\/IEC 23894\u003c\/strong\u003e (risk), \u003cstrong\u003e8183\u003c\/strong\u003e (data life cycle), \u003cstrong\u003e5259\u003c\/strong\u003e (data quality), \u003cstrong\u003eTR 24027\u003c\/strong\u003e (bias)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST AI Risk Management Framework 1.0\u003c\/strong\u003e — GOVERN · MAP · MEASURE · MANAGE — plus the \u003cstrong\u003eGenAI Profile (AI 600-1)\u003c\/strong\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eMITRE ATLAS\u003c\/strong\u003e — the adversarial threat knowledge base for AI\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOWASP Top 10 for LLM Applications (2025)\u003c\/strong\u003e and the \u003cstrong\u003eOWASP ML Security Top 10\u003c\/strong\u003e\n\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEU AI Act\u003c\/strong\u003e — prohibited practices, Annex III high-risk, GPAI, transparency duties — and Canada's Algorithmic Impact Assessment alignment\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (21 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the framework map and the working order\u003c\/li\u003e\n\u003cli\u003eAI Governance Framework Guide — stand up an ISO\/IEC 42001 AI management system (policy, board, inventory, SoA, life-cycle gates)\u003c\/li\u003e\n\u003cli\u003eAI Risk Management Methodology — AI RMF + ISO 23894 method with 5×5 scoring\u003c\/li\u003e\n\u003cli\u003eAI System Impact Assessment Guide — ISO\/IEC 42005 process + EU AI Act classification\u003c\/li\u003e\n\u003cli\u003eAI Threat \u0026amp; Vulnerability Catalogue — ATLAS lifecycle, OWASP LLM Top 10 (2025), OWASP ML Top 10, NIST AI 600-1 risk categories, attack surfaces by AI type\u003c\/li\u003e\n\u003cli\u003eModel Evaluation \u0026amp; Validation Procedure — performance, robustness, independent validation, drift, rollback\u003c\/li\u003e\n\u003cli\u003eGenAI \u0026amp; LLM Security Assessment Procedure — assessing chatbots, copilots, RAG, and agents\u003c\/li\u003e\n\u003cli\u003eBias, Fairness \u0026amp; Human Rights Assessment Procedure — criteria, metrics, thresholds, monitoring\u003c\/li\u003e\n\u003cli\u003eAI Data Governance \u0026amp; Quality Procedure — provenance, ISO 5259 quality, RAG corpus governance\u003c\/li\u003e\n\u003cli\u003eAI Third-Party \u0026amp; Supply Chain Procedure — AI Bill of Materials, due diligence, contract clauses\u003c\/li\u003e\n\u003cli\u003eHuman Oversight, Transparency \u0026amp; Explainability Procedure — oversight that works, disclosure, contest channels\u003c\/li\u003e\n\u003cli\u003eAI Incident Response Playbook — attack and harm events, tested kill switch, notifications\u003c\/li\u003e\n\u003cli\u003eForms: Intake \u0026amp; Classification · Impact Assessment · Model Card · Technical Assessment Plan \u0026amp; Report · Go-Live Approval \u0026amp; Risk Acceptance\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAI Risk Assessment Workbook (Excel)\u003c\/strong\u003e — system inventory + risk register pre-loaded with 29 scored scenarios across all AI types, automatic 5×5 inherent\/residual scoring, dashboard\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAI Controls Crosswalk Workbook (Excel)\u003c\/strong\u003e — 52 consolidated controls mapped to ISO 42001 Annex A, NIST AI RMF, EU AI Act, and OWASP\/ATLAS, with a treatment plan — your working Statement of Applicability\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAI Technical Assessment Test Library (Excel)\u003c\/strong\u003e — 42 ready-to-run test cases in 8 categories with objectives, methods, and pass criteria: prompt injection, privacy, RAG, agents, output handling, ML security, fairness\/quality, governance tests\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e AI governance leads, CISOs and security teams, risk and compliance managers, data science leads, and consultants standing up AI governance for clients — in any sector deploying or buying AI.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice, certification, or a guarantee of compliance with any framework named. Framework mappings are a working consolidation — verify against the official publications.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting","offers":[{"title":"Default Title","offer_id":67834918699195,"sku":"ZEE-AIG-008","price":349.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/ai-governance-toolkit-cover.png?v=1792702629"},{"product_id":"privacy-data-protection-toolkit-law-25-pipeda-gdpr-word-excel","title":"Privacy \u0026 Data Protection Toolkit — Law 25, PIPEDA, GDPR (Word + Excel)","description":"\u003cp\u003eThe complete, ready-to-customise privacy programme for Canadian businesses — and for any business serving EU customers. If Quebec's \u003cstrong\u003eLaw 25\u003c\/strong\u003e and \u003cstrong\u003ePIPEDA\u003c\/strong\u003e apply to you, regulators don't ask whether you \"care about privacy.\" They ask for artefacts: a designated Privacy Officer, published policies, a register of your processing, impact assessments, an incident register, proof you answer rights requests on time and destroy records on schedule. This toolkit gives you every one of those artefacts, drafted to the standard the CAI and the OPC actually test.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRegime coverage:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eQuebec Law 25\u003c\/strong\u003e — Privacy Officer designation and publication (ss. 3.1–3.2), governance policies and transparency (s. 3.8), necessity and consent, privacy by default (s. 9.1), PIAs (s. 3.3), transfers outside Quebec (s. 17), incident notification and the incident register (s. 3.5–3.7), portability, de-indexation, destruction and anonymisation (ss. 21, 23)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePIPEDA\u003c\/strong\u003e — the ten fair information principles, breach of security safeguards reporting to the OPC, individual notification, the real-risk-of-significant-harm (RROSH) assessment, and the 24-month record of every breach\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eGDPR essentials\u003c\/strong\u003e — lawful bases, transparency, data subject rights on a one-month clock, Article 30 records, Article 28 processor contracts, 72-hour breach notification (Art. 33), DPIAs (Art. 35), Chapter V transfers\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 27701\u003c\/strong\u003e-aligned programme structure — the policy, register and assessment cycle map cleanly onto a privacy information management system\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the file map, the three regimes in plain language, and the customisation order\u003c\/li\u003e\n\u003cli\u003ePrivacy Programme Policy — principles, roles, safeguards, individual rights, accountability, ready for executive approval\u003c\/li\u003e\n\u003cli\u003ePrivacy Notice Templates — website notice, customer\/client notice (financial services), employee notice\u003c\/li\u003e\n\u003cli\u003ePrivacy Impact Assessment Template — screening triggers for Law 25 s. 3.3 and GDPR Art. 35, data-flow and necessity analysis, 5×5 risk table, consultation and sign-off\u003c\/li\u003e\n\u003cli\u003ePrivacy Officer Charter — the written designation letter plus duties, authority, publication of title and contact information, deputy and succession\u003c\/li\u003e\n\u003cli\u003eBreach Response Plan — hour-by-hour phases, harm-assessment factors, the CAI \/ OPC \/ supervisory-authority notification table with timing and content, recovery and readiness\u003c\/li\u003e\n\u003cli\u003eData Retention \u0026amp; Disposal Guide — the method for building and running a schedule, legal holds, NIST 800-88-aligned disposal methods and destruction evidence\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRecords of Processing Register (Excel)\u003c\/strong\u003e — purposes, lawful bases, data categories, data subjects, recipients, cross-border transfers, retention and safeguards, pre-loaded with six realistic activities for a small financial-services firm\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePrivacy Compliance Checklist (Excel)\u003c\/strong\u003e — three sheets (Law 25 · PIPEDA · GDPR Essentials), 60 requirements with plain-language explanations, legal references, status dropdowns and evidence tracking\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBreach Register (Excel)\u003c\/strong\u003e — the incident log aligned to PIPEDA's 24-month record duty and the Law 25 register: discovery, harm assessment, notifications, containment, lessons learned\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRetention Schedule (Excel)\u003c\/strong\u003e — 18 example record categories for a small financial-services firm with retention periods, triggers, legal bases (FINTRAC, Income Tax Act, CASL, limitation periods), owners and disposal methods\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e Canadian SMBs — especially MSBs, mortgage, lending, insurance and fintech firms — facing Law 25 and PIPEDA; businesses serving EU customers; privacy and compliance leads and consultants who need a documented, defensible programme without drafting it from zero.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice or a guarantee of compliance with any law named. Statutory references were checked against published texts; privacy law evolves — verify section numbers and penalty figures against the official publications, and involve Canadian privacy counsel for investigations, complaints or reportable breaches.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67862643114171,"sku":"ZEE-PRV-009","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/privacy-data-protection-toolkit-cover.png?v=1792807722"},{"product_id":"operational-resilience-third-party-risk-toolkit-osfi-b-10-e-21-dora-word-excel","title":"Operational Resilience \u0026 Third-Party Risk Toolkit — OSFI B-10\/E-21, DORA (Word + Excel)","description":"\u003cp\u003eWhen a critical vendor fails or a critical operation stops, regulators no longer ask whether you had a policy — they ask for your register, your impact analysis, your tolerances, and your test evidence. This toolkit builds all of it as one connected system: third-party risk management and operational resilience, implemented against the three frameworks that now define the field — \u003cstrong\u003eOSFI B-10\u003c\/strong\u003e (third-party risk), \u003cstrong\u003eOSFI E-21\u003c\/strong\u003e (operational risk \u0026amp; resilience, effective 1 November 2025) and the EU's \u003cstrong\u003eDORA\u003c\/strong\u003e (Regulation (EU) 2022\/2554, applying since 17 January 2025) — aligned throughout to \u003cstrong\u003eISO 22301\u003c\/strong\u003e business continuity practice.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eFramework stack:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eOSFI Guideline B-10\u003c\/strong\u003e — Third-Party Risk Management: governance, inventory \u0026amp; materiality, due diligence, contract provisions, monitoring, fourth parties, concentration risk, exit strategies\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOSFI Guideline E-21\u003c\/strong\u003e — Operational Risk Management and Resilience: critical operations, tolerances for disruption, end-to-end dependency mapping, severe-but-plausible scenario testing\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eEU DORA — Regulation (EU) 2022\/2554\u003c\/strong\u003e — ICT risk management, major-incident classification \u0026amp; reporting, resilience testing and TLPT, ICT third-party risk: the Article 28(3) register of information, pre-contract assessment, Article 30 contractual provisions, exit strategies\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO 22301\u003c\/strong\u003e — business impact analysis, continuity strategies, plans, and exercise programmes (clauses 8.2–8.5)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the framework map, how the pieces fit, and the order to work in\u003c\/li\u003e\n\u003cli\u003eThird-Party Risk Management Policy — the full B-10 lifecycle: four risk tiers with approvals, due-diligence depth by tier, mandatory contract provisions, fourth-party and concentration rules, monitoring cadence, tested exit strategies\u003c\/li\u003e\n\u003cli\u003eBusiness Impact Analysis Guide and Template — the seven-step BIA method, an impact rating scale, and fill-in process and dependency tables with a worked example: impacts over time, MTPD, RTO\/RPO, minimum service levels, E-21 tolerance statements\u003c\/li\u003e\n\u003cli\u003eBusiness Continuity Plan Template — activation criteria and severity guide, response teams, the first-four-hours procedure, strategies for system loss, vendor outage, facility loss, workforce loss, cyber incidents and regional events, backlog and stand-down management\u003c\/li\u003e\n\u003cli\u003eDisaster Recovery Plan Template — tiered systems inventory, 3-2-1-1-0 backup standards, recovery sequencing and failback, SaaS\/vendor recovery handling, restore and failover testing requirements\u003c\/li\u003e\n\u003cli\u003eCrisis Communications Pack — spokesperson and approval rules plus pre-approved templates: holding statements (disruption, cyber, vendor failure), internal staff notice, customer notice, regulator notification, service-restored message, media Q\u0026amp;A preparation\u003c\/li\u003e\n\u003cli\u003eResilience Testing and Exercises Guide — seven test types and what each proves, programme rules, a six-scenario library (ransomware, 48-hour vendor outage, cloud region failure, facility loss, workforce loss, backup compromise) with injects and success criteria, and a 1–5 scoring rubric\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Due Diligence Questionnaire (Excel)\u003c\/strong\u003e — 46 resilience-focused questions in 8 sections: financial viability, business continuity, disaster recovery, insurance, subcontractors \u0026amp; fourth parties, concentration risk, exit \u0026amp; portability, governance \u0026amp; track record — Yes\/Partial\/No\/N\/A dropdowns, reviewer guidance on every question, and an automatic scoring summary with a suggested tier\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVendor Criticality Register (Excel)\u003c\/strong\u003e — your B-10 inventory and DORA register of information: criticality tier, materiality, critical-operation support, substitutability, data locations, contract dates and notice periods, due-diligence dates, monitoring frequency, exit-strategy status — with a summary dashboard flagging overdue reviews and contracts expiring within 180 days\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eResilience Gap Checklists (Excel)\u003c\/strong\u003e — 59 requirements across three sheets (OSFI B-10: 20 · OSFI E-21: 18 · EU DORA: 21), each with a plain-English explanation, status dropdown, owner and evidence columns\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTesting and Exercise Log (Excel)\u003c\/strong\u003e — the examiner-ready evidence log for every exercise and test, with findings, actions, owners and due dates, plus an annual programme planner\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e operational risk and resilience leads, third-party risk and vendor management teams, business continuity managers, CIOs and CISOs, and compliance teams at banks, credit unions, insurers, payment and fintech firms — and any organization whose customers, insurers, or regulators now ask B-10, E-21 or DORA questions. Pairs with the Vendor Security Assessment Pack: that pack tests a vendor's security controls; this one tests whether the vendor keeps you running — and lets you leave.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice, certification, or a guarantee of compliance with any framework named. Framework summaries are a working consolidation — verify requirement text against the official publications (OSFI; EUR-Lex) and the applicable technical standards.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67862651666619,"sku":"ZEE-RES-010","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/operational-resilience-tprm-toolkit-cover.png?v=1792807729"},{"product_id":"incident-response-security-operations-toolkit-playbooks-tabletops-soc-readiness-word-excel","title":"Incident Response \u0026 Security Operations Toolkit — Playbooks, Tabletops, SOC Readiness (Word + Excel)","description":"\u003cp\u003eThe complete working system for responding to security incidents — and for running the security-operations routines that keep one incident from becoming the next one. An incident response plan, seven step-by-step playbooks, a tabletop exercise kit, pre-approved communications, a post-incident review template, and the Excel registers and trackers that turn incidents into permanent improvement.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eFramework stack:\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST SP 800-61\u003c\/strong\u003e — the incident response life cycle: preparation, detection \u0026amp; analysis, containment \/ eradication \/ recovery, post-incident activity (Rev. 3 maps it to the CSF 2.0 Respond and Recover functions)\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eISO\/IEC 27035\u003c\/strong\u003e — incident management principles, planning and operations\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eNIST Cybersecurity Framework 2.0\u003c\/strong\u003e — Respond (RS) and Recover (RC) categories for executive and auditor reporting\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCIS Critical Security Controls v8\u003c\/strong\u003e — Control 17 (Incident Response Management) and Control 7 (Continuous Vulnerability Management), supported by Controls 8, 10, 11 and 13\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eMITRE ATT\u0026amp;CK\u003c\/strong\u003e — detection use cases framed as attacker behaviours\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (11 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — how the plan, playbooks, tabletops and registers operate as one loop, and the customisation order\u003c\/li\u003e\n\u003cli\u003eIncident Response Plan Template — severity model (SEV1–SEV4), roles and deputies, escalation and notification clocks, evidence handling, NIST life cycle end to end\u003c\/li\u003e\n\u003cli\u003eIncident Playbooks — ransomware, business email compromise, malware outbreak, insider incident, DDoS, lost or stolen device, cloud account compromise; each with triage, containment, eradication, recovery and communication steps\u003c\/li\u003e\n\u003cli\u003eTabletop Exercise Kit — facilitator guide, three full scenarios with timed injects (ransomware Friday, BEC payment fraud, cloud account compromise), a six-dimension scoring rubric, and after-action prompts\u003c\/li\u003e\n\u003cli\u003eIncident Communications Templates — internal alert, staff notice, customer notice, regulator \/ law-enforcement notification worksheet, media holding statement\u003c\/li\u003e\n\u003cli\u003ePost-Incident Review Template — timeline reconstruction, root-cause analysis (5 Whys), impact assessment, action tracker, sign-off\u003c\/li\u003e\n\u003cli\u003eVulnerability Management Programme Guide — scanning cadence, CVSS severity SLAs, patch governance rings, and a governed exception \/ risk-acceptance process with approval levels and maximum durations\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eIncident Register (Excel)\u003c\/strong\u003e — every incident with type, severity, owner, status and PIR linkage, plus a live summary by severity, status and type\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eVulnerability Management Tracker (Excel)\u003c\/strong\u003e — findings with automatic severity from CVSS, SLA days and due-date calculation, overdue flags, and live summary counts\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSOC Readiness Checklist (Excel)\u003c\/strong\u003e — 29 readiness items across people, process, technology, log sources and detection use cases, with maturity ratings and an overall readiness score\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e CISOs and security leads, SOC and IT operations managers, incident response managers, GRC teams preparing for ISO 27001 \/ SOC 2 evidence on incident management, and consultants building response capability for clients.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not legal advice, certification, or a guarantee of compliance with any framework named. Breach-notification duties differ by jurisdiction and sector — the templates use bracketed placeholders for your confirmed clocks. Framework mappings are a working consolidation — verify against the official publications.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67862652092603,"sku":"ZEE-OPS-011","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/incident-response-secops-toolkit-cover.png?v=1792807733"},{"product_id":"security-project-delivery-toolkit-charters-raid-remediation-tracking-word-excel","title":"Security Project Delivery Toolkit — Charters, RAID, Remediation Tracking (Word + Excel)","description":"\u003cp\u003eSecurity projects rarely fail on technology — they fail on unclear scope, invisible risks, decisions nobody recorded, and audit findings that aged quietly in a slide deck. This toolkit is the delivery system that prevents all four: the charters, plans, logs, and reporting templates a competent programme office uses to run security work — an MFA rollout, a SIEM implementation, an endpoint refresh, a remediation programme — from approval to closure, with an audit trail an assessor can follow.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eDelivery method, aligned and practical:\u003c\/strong\u003e stage and tolerance concepts follow \u003cstrong\u003ePRINCE2\u003c\/strong\u003e, process vocabulary follows the \u003cstrong\u003ePMBOK® Guide\u003c\/strong\u003e, and the planning cadence works with \u003cstrong\u003eagile delivery\u003c\/strong\u003e (sprints, backlogs, increments) as readily as phased rollouts. No certification required — the templates slot into the governance you already run.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (10 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the pack map, the five-stage delivery workflow (charter → plan → control → report \u0026amp; decide → close \u0026amp; learn), and the customisation order\u003c\/li\u003e\n\u003cli\u003eSecurity Project Charter Template — business case, objectives, measurable success criteria, scope in\/out, governance, budget, headline risks, sponsor sign-off — plus a fully worked fictional example (an organisation-wide MFA rollout)\u003c\/li\u003e\n\u003cli\u003eProject Plan and RACI Guide — building the plan in six steps, security rollout waves and pilot gates, estimating rules, and a completed RACI matrix to adapt\u003c\/li\u003e\n\u003cli\u003eStatus Reporting Pack — weekly status report and monthly executive summary templates, plain-English RAG rules that can't be gamed, milestone and budget tracker tables, reporting rhythm\u003c\/li\u003e\n\u003cli\u003eSteering Committee Briefing Template — the one-page, decisions-first format: decisions needed with costed options, progress vs charter, top risks, and the asks\u003c\/li\u003e\n\u003cli\u003eChange Request and Decision Log Guide — the five-step change-control process, impact-assessment checklist, approval thresholds, and how to run both logs so they survive audit scrutiny\u003c\/li\u003e\n\u003cli\u003eProject Closure and Lessons Learned — ten-point closure checklist, benefits check template, a 90-minute lessons-learned workshop format, and the lessons register\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRAID Log (Excel)\u003c\/strong\u003e — six linked registers: Risks (automatic exposure scoring), Assumptions, Issues, Dependencies, Change Log, Decision Log — dropdowns throughout and worked example rows from the fictional rollout\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRemediation Tracker (Excel)\u003c\/strong\u003e — every audit, assessment, and pen-test finding with source, severity, owner, agreed action, due date, status dropdown, and evidence link; automatic days-open and OVERDUE flags; live summary counts at the top\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e security project and programme managers, PMO leads, CISOs and security managers running rollouts, consultants delivering security projects for clients, and GRC teams who need findings tracked to verified closure.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not professional project-management advice or a guarantee of project outcomes. PMBOK is a registered mark of the Project Management Institute and PRINCE2 is a registered trade mark of PeopleCert; this toolkit is not an official publication of either and confers no credential.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67862659825851,"sku":"ZEE-PMD-012","price":199.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/security-project-delivery-toolkit-cover.png?v=1792807736"},{"product_id":"project-management-toolkit-charters-plans-raid-reporting-word-excel","title":"Project Management Toolkit — Charters, Plans, RAID \u0026 Reporting (Word + Excel)","description":"\u003cp\u003eMost projects do not fail because the work was hard — they fail because nobody wrote down what was agreed, who owned what, what could go wrong, or how decisions would be made, and then the project paid for those gaps in rework, delays, and budget overruns. This toolkit is the management system that closes those gaps: charters, plans, stakeholder registers, status reports, risk and issue logs, change control, business cases, and closure documents for running any project — a system implementation, an office move, a product launch, a process redesign — from approval to closure, with a record a reviewer can follow.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eDelivery method, aligned and practical:\u003c\/strong\u003e stage, tolerance, and exception concepts follow \u003cstrong\u003ePRINCE2\u003c\/strong\u003e, process vocabulary follows the \u003cstrong\u003ePMBOK® Guide\u003c\/strong\u003e, and the planning cadence works with \u003cstrong\u003eagile delivery\u003c\/strong\u003e (sprints, backlogs, increments) as readily as phased, plan-driven delivery. No certification required — the templates slot into the governance you already run.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the pack map, the five-stage project workflow (authorise → plan → control → report \u0026amp; decide → close \u0026amp; learn), and the customisation order\u003c\/li\u003e\n\u003cli\u003eProject Charter Template — business case summary, objectives, measurable success criteria, scope in\/out, governance, budget, headline risks, sponsor sign-off — plus a fully worked fictional example (an inventory management system replacement)\u003c\/li\u003e\n\u003cli\u003eProject Plan and Schedule Guide — work breakdown structure, dependencies, critical path, milestones, float, baselining, rolling-wave planning, and schedule compression done properly\u003c\/li\u003e\n\u003cli\u003eStakeholder Register and Communications Plan — power\/interest analysis, a RACI-lite responsibility table, and a communications plan with cadence, audience, and channel\u003c\/li\u003e\n\u003cli\u003eStatus Reporting Pack — weekly status report and monthly executive summary templates, plain-English RAG rules that can't be gamed, milestone and budget tracker tables, reporting rhythm\u003c\/li\u003e\n\u003cli\u003eRisk and Issue Management Guide — risk identification, a 5×5 scoring matrix, response strategies, the issue escalation ladder, and the review cadence that keeps both honest\u003c\/li\u003e\n\u003cli\u003eChange Control and Governance Guide — the five-step change process, impact-assessment checklist, approval thresholds, governance bodies, and stage gates\u003c\/li\u003e\n\u003cli\u003eBusiness Case Template — problem, options analysis with scoring, costs and benefits, risks, and recommendation — with a worked fictional options table\u003c\/li\u003e\n\u003cli\u003eProject Closure and Lessons Learned — nine-point closure checklist, benefits check template, handover, a 60-minute lessons-learned workshop format, and the lessons register\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProject Plan Tracker (Excel)\u003c\/strong\u003e — every task and milestone with owner, dates, percent complete, status dropdown, automatic RAG and overdue flags, budget vs actual with variance, and a live summary block\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRAID Log (Excel)\u003c\/strong\u003e — four registers: Risks (automatic exposure scoring), Assumptions, Issues, Dependencies — dropdowns throughout and worked example rows from the fictional project\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e project managers, PMO leads, programme managers, sponsors and business owners running system implementations, office moves, product launches, and process redesigns — and consultants delivering projects for clients.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not professional project-management advice or a guarantee of project outcomes. PMBOK is a registered mark of the Project Management Institute and PRINCE2 is a registered trade mark of PeopleCert; this toolkit is not an official publication of either and confers no credential.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67883118493883,"sku":"ZEE-PM-013","price":249.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/project-management-toolkit-cover.png?v=1792861767"},{"product_id":"business-analysis-toolkit-brds-process-maps-traceability-uat-word-excel","title":"Business Analysis Toolkit — BRDs, Process Maps, Traceability \u0026 UAT (Word + Excel)","description":"\u003cp\u003eMost failed projects were not failed builds — they were failed understandings. Nobody agreed what the business actually needed, the process was never mapped before it was automated, and nobody could prove, at the end, that what was delivered matched what was asked for. This toolkit is the discipline that prevents that: it takes an initiative from a vague request (“we need a better onboarding process”) to a signed business requirements document, a mapped process, a traceable set of functional requirements and user stories, and a user acceptance test that means something.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eThe workflow, in four beats:\u003c\/strong\u003e \u003cstrong\u003eelicit\u003c\/strong\u003e (discover what the business actually needs, and record who asked for what), \u003cstrong\u003eanalyse\u003c\/strong\u003e (map the process as it really runs, name the gaps, assess the options honestly), \u003cstrong\u003especify\u003c\/strong\u003e (write, agree, and sign the requirements, then turn them into buildable stories), and \u003cstrong\u003evalidate\u003c\/strong\u003e (prove the delivered thing does what was asked, with traceability and a real sign-off).\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eWhat's included (12 items):\u003c\/strong\u003e\u003c\/p\u003e\n\u003cul\u003e\n\u003cli\u003eStart Here Guide — the pack map, the elicit → analyse → specify → validate workflow, and the customisation order (ID conventions, MoSCoW prioritisation, stakeholder-first sequencing)\u003c\/li\u003e\n\u003cli\u003eBusiness Requirements Document Template — objectives, scope in\/out, business requirement table, non-functional requirements, constraints and assumptions, sign-off — plus a fully worked fictional example (a retail customer onboarding redesign: 11 days → 3 days, rework 18% → under 5%)\u003c\/li\u003e\n\u003cli\u003eFunctional Requirements and User Stories Guide — turning business requirements into testable functional requirements, the “As a \/ I want \/ so that” story format, Given\/When\/Then acceptance criteria, INVEST readiness, story splitting, and MoSCoW applied honestly\u003c\/li\u003e\n\u003cli\u003eProcess Mapping Guide — BPMN basics (events, tasks, gateways, swimlanes), the six-step as-is → to-be method, a half-day mapping workshop format, and a worked as-is\/to-be example with measures\u003c\/li\u003e\n\u003cli\u003eGap Analysis Template — current state from evidence, measurable target state, the gap table, options analysis across build \/ buy \/ outsource \/ process change \/ do nothing (scored on shared criteria), recommendation and roadmap\u003c\/li\u003e\n\u003cli\u003eStakeholder Analysis and Engagement Plan — stakeholder register, power\/interest grid, RACI-lite for the analysis work, engagement and communications plan, and handling resistance early\u003c\/li\u003e\n\u003cli\u003eUAT Planning and Test Case Templates — UAT plan with entry and exit criteria, the test case template, defect severity and triage rules, and per-scope-area sign-off\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRequirements Traceability Matrix Guide\u003c\/strong\u003e — RTM structure, the four traceability rules (no untested requirements, no orphan tests), maintaining the RTM through change, and monthly health checks\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eRequirements Register (Excel)\u003c\/strong\u003e — the living log of every requirement: ID, category, source, MoSCoW priority, status, owner, linked process, and traceability to the test case — dropdowns throughout, worked example rows\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eProcess Inventory (Excel)\u003c\/strong\u003e — the process catalogue: owner, frequency, systems, monthly volume, pain points, improvement priority, target state, and status — dropdowns throughout, worked example rows\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eUAT Test Log (Excel)\u003c\/strong\u003e — test cases with steps, expected and actual results, pass\/fail\/blocked dropdowns, a linked defect sheet with severity and priority, and live summary counts including pass rate\u003c\/li\u003e\n\u003cli\u003eCopyright \u0026amp; Licence Terms\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003cp\u003e\u003cstrong\u003eWho it's for:\u003c\/strong\u003e business analysts, project managers, product owners, and consultants who need to turn vague business requests into signed requirements, mapped processes, and acceptance tests — and teams whose last project failed on misunderstood requirements rather than on technology.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c\/strong\u003e Templates and general information, not professional business-analysis advice or a guarantee of project outcomes. BABOK® Guide is a registered mark of IIBA® and BPMN is a standard of the Object Management Group (OMG); this toolkit is not an official publication of either, does not certify anything, and confers no credential (including CBAP).\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eCopyright \u0026amp; licence:\u003c\/strong\u003e © 2026 Zee Consulting. All rights reserved. This product and everything in it is the intellectual property of Zee Consulting. Your purchase gives one named organization a licence to use and customize the documents for its own internal business — nothing more. The files must not be resold, shared, redistributed, sublicensed, or given to clients or any other organization, in original or modified form. Anyone who uses these materials without a licence is infringing copyright, and Zee Consulting reserves the right to pursue litigation and claim damages and legal costs to the fullest extent permitted by law. The full Copyright \u0026amp; Licence Terms are included in the download (Copyright_and_Licence_Terms.docx) and inside the Start Here guide.\u003c\/p\u003e\n\u003cp\u003e\u003cstrong\u003eRequirements:\u003c\/strong\u003e Microsoft Word and Excel (or compatible: Google Docs\/Sheets, LibreOffice). Instant download after purchase — no shipping, no waiting.\u003c\/p\u003e","brand":"Zee Consulting Templates","offers":[{"title":"Default Title","offer_id":67883123507387,"sku":"ZEE-BA-014","price":299.0,"currency_code":"CAD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0777\/6570\/5915\/files\/business-analysis-toolkit-cover.png?v=1792861776"}],"url":"https:\/\/zeeconsulting.myshopify.com\/collections\/compliance-templates.oembed","provider":"Zee Consulting Templates","version":"1.0","type":"link"}