IT and security policy kit for small businesses

Editable Word documents, Excel sheets and a checker script: a baseline of security policies you can adapt in an afternoon. One license for your own organisation, or one for IT providers who write policies for many clients.

What is inside

14 Word documents (.docx, editable)

A start-here guide: how to set the kit up, which laws may apply to you, and a checklist for handing edited documents to a client.
Twelve policies: information security; acceptable use; AI tools and client data; passwords and multi-factor authentication; email and phishing; backup and recovery; incident response; access control with joiner, mover and leaver checklists; remote work and personal devices; vendors and cloud services; data retention and disposal; and a one-hour awareness session with a ten-question quiz.
A policy acknowledgement form for staff.

Three Excel spreadsheets and a script

An asset and access register, a 26-control security basics self-check with a summary, and a policy review calendar that shows what is overdue.
A Python script that shows which SPF, DMARC and common DKIM records a domain publishes (Python 3.8 or later, 21 offline tests).

How it is built

Policy text is clean: notes about sources sit in a short appendix at the end of each document that you delete before use.
Yellow fields mark what you fill in. Rules that do not fit your business are meant to be deleted.
The incident response plan does not assume that one law covers everyone: it has a table for your own law, regulator and deadlines.
The AI tools policy covers data classes, an approved-tools table, sending as little as possible, and a person checking AI output.

Pricing

Standard license: 59 EUR

For one organisation (one legal entity and the companies it controls). Use, edit and keep the documents, spreadsheets and script inside your organisation. One-time payment, instant download.

MSP license: 149 EUR

For one IT provider, consultant or agency that writes policies for its clients. Use and adapt the kit for an unlimited number of client organisations and deliver the edited documents to them; clients keep their edited documents. One-time payment, instant download.

Prices are in euro and before tax; VAT or sales tax is added at checkout where it applies. Payment is processed by Paddle.com, our reseller and Merchant of Record. 30-day money-back guarantee: see the refund policy. Full text: license terms and terms of sale.

Questions before you buy: info@aetherline.llc. We reply within one business day, Central European Time.

What it is not

These are templates, not legal advice. They do not make a business compliant with any law, standard or contract. Where a law, a client contract or an insurer applies, check what it asks.
The documents were drafted by an AI assistant (Claude) and reviewed by other AI models in two rounds. No outside human security or legal professional has reviewed them yet.
Some rules come from our own practice and have not been tested on other organisations.

Use it with an AI assistant

The kit is plain Word and Excel files, so any AI assistant can help you adapt it. Two prompts that work with the files. Paste only the policy text and your own answers: no client data, passwords or personal data. Read every change the assistant makes.

Adapt a policy to your business

Below is a policy template. Text in [[double square brackets]] is a field to fill in.
About my organisation: [number of staff, country, main systems, whether we handle data for clients].
1. Fill every field you can from what I told you. List the fields you could not fill, and ask me for them. Do not invent facts about my business.
2. Do not name laws, deadlines or regulators from memory; where one may apply, write "check which law applies" and tell me to confirm it.
3. List every rule you removed or changed and why, so I can review it.
Template:
[paste the policy text here]

Turn the self-check into a fix list

Below are my answers to a 26-control security basics self-check (control name and yes / partly / no).
My organisation: [number of staff, main systems].
Sort the controls answered "no" or "partly" by what to fix first for an organisation like mine. For each, give one concrete first step I can finish in a day and say why it comes before the next one. Do not say that I comply or do not comply with any standard or law.
Answers:
[paste the controls and your answers here]

Try it free

Answer the 26-control self-check to see what to fix first, and check your own domain's email records. Read the first pages of two of the policies.

Download the self-check (Excel) Download the email checker

AI tools policy: first pages (PDF) Incident response plan: first pages (PDF)

The email checker needs Python 3.8 or later and runs on your computer. It sends DNS queries for the domain you type to Cloudflare's public DNS service, which sees them and your IP address; the script sends no files or other data. Its tests are in test_check_email_auth.py.