Practical cyber policies, checklists, registers and starter packs for small businesses, charities and organisations without a dedicated security team.
The Field Manual is designed as a simple hierarchy of policies, standards, guidelines and procedures — helping small organisations understand what good looks like and how to put it into practice.
A simple NCSC-inspired starter pack for cafés, shops, salons, trades, small charities and other small organisations with tills, email, a few devices and maybe a website.
Essential cyber templates for micro and small businesses. Includes basic policies, an asset register, backup checklist, phishing checklist and incident reporting form.
A standard pack for small offices, accountants, estate agents, small hotels, agencies and professional services firms using Microsoft 365, Google Workspace, cloud tools and client data.
A larger pack for growing organisations, supplier-heavy businesses, hotel chains, factories and organisations needing governance, risk, supplier, incident and recovery templates.
The free pack is designed to help small organisations take their first practical cyber steps without being overwhelmed by a large policy library.
A simple governance policy to define who is responsible for cyber security, how often it should be reviewed and what staff are expected to do.
Simple rules for passwords, multi-factor authentication, shared accounts, starters, leavers and protecting important online services.
A simple asset register and backup checklist to help track devices, tills, laptops, phones, cloud tools and important business data.
A checklist to help staff spot suspicious emails, messages, links, invoices and payment-change requests.
A simple incident reporting form so staff can record what happened, when it happened, who was affected and what action was taken.
A plain-English checklist covering backups, updates, MFA, access, phishing, devices, websites and basic incident response.
Additional templates and policy documents will be added to the Field Manual over time.
Define roles, escalation routes, evidence capture, communication steps, containment activity and recovery actions.
Open templateSet simple rules for safe, responsible and approved use of AI tools at work.
Open templateQuestions to ask suppliers before sharing data, granting access or relying on their services.
Open template