Cybersecurity & Privacy
Cybersecurity and privacy workflow templates for security incidents, data breaches, phishing reports and vulnerability remediation, plus privileged and software access requests, user access reviews, firewall changes and security exceptions. Privacy impact assessments, data subject access requests, third-party security assessments, security awareness training and a privacy enquiry form are included too.
Benefits
- Respond to incidents and breaches with clear owners and due dates
- Approve and review access with a record of every decision
- Handle privacy requests and assessments consistently
Common Use Cases
Cybersecurity & Privacy Templates(14)
Security Incident Response Workflow
Captures suspected cyber security incidents, uses AI to rate severity (with human fallback), coordinates escalation, containment/investigation/eradication response, optional external notification, and recovery sign-off through to closure with reporter notification.
Data Breach Response Workflow
Manages the end-to-end response to a suspected personal/sensitive data breach: intake and acknowledgement, investigation, privacy/legal review and notification decision, regulator/individual notification if required, remediation, and closure — with status tracking throughout.
User Access Review Workflow
Collects a user access review request, sets a 14-day due date, has the system owner certify access against least privilege, saves the certification outcome to the record, remediates any flagged access via IT with system-owner confirmation (looping until resolved), and closes the review with an outcome email.
Vulnerability Remediation Workflow
Intake and triage of reported vulnerabilities through validation, owner response (remediate or accept risk), fix verification, and closure with reporter notifications at each key milestone.
Privacy Impact Assessment Workflow
Manages privacy impact assessments end-to-end: intake of an initiative, privacy officer screening, full assessment by a privacy assessor when required, officer approval with rework loop, owner acceptance of residual risk, and closure with next review date tracking.
Data Subject Access Request Workflow
Manages a data subject access request end-to-end: intake and acknowledgement, identity verification (with a re-request loop), records search and redaction (with a rejection rework loop), privacy officer approval, secure delivery, and completion notification.
Firewall Change Request Workflow
Manages firewall/network rule change requests end-to-end: intake, security risk review, risk-based approval routing (security manager for high risk, network owner otherwise), implementation and testing, and — for temporary rules — scheduled removal, with status tracking and requester notifications throughout.
Phishing Report and Response Workflow
Collects phishing reports from staff, notifies the reporter, triggers immediate credential reset if they interacted with the message, has a security analyst assess the message, and drives containment or closure actions with reporter notifications throughout.
Privacy Enquiry Contact Form Workflow
Website privacy enquiry intake that acknowledges the enquirer, uses AI to prioritise the enquiry (escalating to a human when unsure), assigns the privacy officer to handle it, and routes formal data rights requests to a dedicated data requests process while closing general enquiries with a response.
Privileged Access Request Workflow
Handles requests for elevated/privileged system access: intake, manager and system-owner approval, an additional security team review for high-risk requests, IT provisioning, and notifications, with full status tracking and reporting.
Security Awareness Training Workflow
Tracks assignment and completion of security awareness training for each employee in a campaign: assigns the course, records results (including a retake cycle), follows up on overdue/outstanding training, and reports status across the campaign.
Security Exception Workflow
Captures requests for exceptions to security policies or controls, routes them through security team risk assessment, obtains approval from the CISO (High risk) or Security Manager (Low/Medium risk), and notifies the requester of the outcome with recorded expiry date and review conditions.
Software Access Request Workflow
Captures software access requests, routes them through manager and system owner approval, adds security review for privileged access, provisions access via IT, verifies the access works with the requester's user, and tracks status through to completion.
Third-Party Security Assessment Workflow
Assesses a vendor's security posture end-to-end: intake of vendor and assessment owner details, sending a security questionnaire to the vendor contact, internal review of the findings by a security reviewer, risk manager approval of residual risk, and notification of the outcome to the vendor and assessment owner.
Frequently Asked Questions
What Cybersecurity & Privacy workflow templates are included?
Cybersecurity & Privacy includes templates for security incident response, data breach response, phishing reports, vulnerability remediation, privileged and software access requests, user access reviews, firewall change requests, security exceptions, third-party security assessments, security awareness training, privacy impact assessments, data subject access requests and a privacy enquiry form.
Who are the Cybersecurity & Privacy templates for?
They're designed for security teams, IT, privacy officers and system owners. Staff and the public report issues and requests through forms, and each responder records findings and decisions on their tasks.
Can I change a cybersecurity and privacy template to suit my organisation?
Yes. Publish the template and it runs straight away, with no installation. Describe the change in plain English — for example, change the severity levels or add a legal review before breach notifications — or edit the steps in the workflow editor. Earlier versions are kept.
Will these templates make us compliant with privacy or security requirements?
They help you keep consistent records — decisions, approvals and investigation findings, with a timeline for each record. Each organisation should confirm the privacy and security obligations that apply to it, such as notification requirements, and adjust the templates to match.