Kept logoKept

Free Cyber Essentials policy templates

The three documents assessors ask for most: a patching policy, an access control policy and a director's declaration. Give us your email and download them as PDFs.

What you get

  • Patching policy — How you keep software supported and updated within 14 days.
  • Access control policy — Named accounts, least privilege and multi-factor authentication.
  • Director's declaration — The signed statement your assessor asks a director to make.

Prefer templates that update themselves and keep your evidence together? See the Kept workspace.

Where should we send them from?

We will put this at the top of each policy for you.

We store your details so we can follow up about Cyber Essentials. No sharing with anyone else — see our privacy notice.