Free Resources

A structured self-assessment for evaluating your organization's current cybersecurity posture. Use it before a board conversation about security investment, before engaging a consultant, or as part of an annual review.

Covers the baseline security domains most organizations need to address:

• Identity and access management
• Endpoint protection
• Network security
• Data handling and classification
• Incident response readiness
• Vendor and third-party risk

The goal isn't a score. It's a starting point for a productive conversation about where your organization actually stands — and what needs attention before the next incident or audit.

The Standardized Information Gathering (SIG) questionnaire is the industry standard for vendor security assessments. The SIG Lite is a streamlined version designed for lower-risk vendor relationships — comprehensive enough to be meaningful, lean enough to actually get completed.

Use it when you're building a vendor risk management program, when your customers are asking about your security posture, or when you need to evaluate a new vendor relationship without the overhead of the full SIG.

Core domains covered:

• Data protection and classification
• Access control and identity management
• Incident detection and response
• Business continuity and disaster recovery
• Physical and environmental security

This is the right starting point for most organizations. The full SIG is available when the engagement or regulatory requirements warrant it.

Google Cloud Identity is Google's identity and access management platform — and its free tier is one of the most underutilized tools in the SMB technology stack.

The free tier (Cloud Identity Free) gives you:

• Up to 50 managed user accounts
• Google as your identity provider (SAML SSO to connected applications)
• Basic device management for Android and Chrome OS
• Security reporting and audit logs

What this means in practice: you can use Google as your identity provider at no cost. If your organization already uses Google Workspace for email and productivity, you likely have this capability and aren't using it. If you're a small team that needs a directory and basic SSO but can't justify a JumpCloud or Okta subscription, Cloud Identity Free may be enough.

The limits: no Gmail, no Google Drive, no the rest of Workspace. This is strictly identity management. The free tier also caps at 50 accounts — above that, you're looking at Cloud Identity Premium or Google Workspace.

Where it fits: organizations with tight budgets that need a starting point for identity management, or teams supplementing another directory with Google's IdP capabilities for specific applications.

How to access it: Google Admin console → create a Cloud Identity Free account at admin.google.com.

Every Microsoft 365 tenant includes Entra ID Free. Most organizations using Microsoft 365 are sitting on this capability without realizing the full scope of what's available.

The free tier includes:

• Unlimited users and groups
• SSO with up to 10 apps per user
• Microsoft Authenticator-based MFA
• Self-service password reset for cloud-only accounts
• Basic identity protection reports
• B2B collaboration (guest access)

What requires paid licensing (P1/P2): Conditional Access policies, advanced identity protection, Privileged Identity Management, and custom sign-in branding. Conditional Access in particular is where the real security value lives.

The practical implication: before purchasing additional identity tools or security products, map what your Microsoft licensing actually includes. Microsoft 365 Business Premium includes Entra ID P1. E3 and E5 include increasingly deep security capabilities. Many organizations are paying for third-party tools that duplicate features they already own.

Pro tip: Microsoft licensing is genuinely confusing. If you're not sure what you have, pull your license inventory from the Microsoft 365 admin center. You might be surprised.

Apple Business is a free platform from Apple that gives organizations centralized control over Apple devices, managed identities, app distribution, and — as of its current iteration — a full built-in MDM solution. Everything you need to manage a fleet of Apple hardware is included at no cost.

What's included at no cost:

• Full MDM — device policy enforcement, app management, configuration profiles, and compliance reporting built directly into the platform, no third-party MDM required
• Up to 500 Managed Apple IDs with your organization's domain — functioning corporate Apple accounts with iCloud Mail, separate from any personal Apple IDs your staff may have
• Automated Device Enrollment — new iPhones, iPads, and Macs enroll into management the moment they're powered on, without IT touching the device
• Volume Purchase Program — centrally purchase and distribute apps across your organization, with licenses that return to the pool when a user leaves
• Integration with third-party MDMs — Jamf, Intune, Mosyle, Kandji, and others remain supported for organizations that need their extended capabilities

On Managed Apple IDs: each one comes with an @yourdomain.com iCloud Mail address. For organizations that need Apple accounts for device management but don't want employees using personal Apple IDs on corporate hardware, this is the right answer. The 500-account limit covers most mid-market organizations without any cost.

If your organization has Apple devices and isn't using Apple Business, you're managing those devices manually. Setup requires a D-U-N-S number for verification, which most organizations already have. Apple's verification process typically takes a few business days.

Route 53 is Amazon's DNS service. It costs approximately $0.50/month per hosted zone. It runs on the same global infrastructure that powers a significant portion of the internet. For most organizations, this is a straightforward upgrade from your domain registrar's free DNS.

Why it matters:

Your domain registrar's DNS (GoDaddy, Namecheap, Squarespace, wherever you registered your domain) is fine until it isn't. DNS outages do happen. Registrar DNS infrastructure is typically less redundant than Route 53's global anycast network, which has a 100% uptime SLA.

Beyond reliability, Route 53 gives you:

• Sub-second propagation in most cases (registrar DNS often takes hours)
• Programmatic management via API, CLI, or Terraform — critical for organizations managing infrastructure as code
• Health checks and DNS failover — Route 53 can automatically route traffic away from an unhealthy endpoint
• Latency-based and geolocation routing for global deployments

Migration takes about 30 minutes: export your existing records, create a hosted zone in Route 53, add your records, update the NS records at your registrar. Done. Your registrar still owns the domain registration — Route 53 just handles resolution.

At $0.50/month for a critical piece of your infrastructure, this is one of the easiest recommendations to make.

If your organization is a registered 501(c)(3) and you're not taking advantage of the following programs, you're paying for things you shouldn't be.

TechSoup — The central clearinghouse for nonprofit technology discounts. Register at techsoup.org and access steeply discounted software from Microsoft, Adobe, Cisco, Symantec, and many others. Verification takes a few weeks but unlocks access to dozens of vendor programs simultaneously. Start here.

Google for Nonprofits — Eligible nonprofits get Google Workspace for Nonprofits free (Business Starter equivalent, including Gmail, Drive, Meet, and more). Also includes YouTube Nonprofit Program and Google Ad Grants ($10,000/month in free Google Search advertising). Apply at google.com/nonprofits. Verification happens through TechSoup.

Microsoft for Nonprofits — Eligible nonprofits get Microsoft 365 Business Premium free for up to 10 users, then significantly reduced pricing beyond that. Also includes $3,500/year in Azure credits and discounted Dynamics 365. Apply through Microsoft's nonprofit portal (microsoft.com/nonprofits).

1Password — Significantly reduced pricing for nonprofits. If your organization manages shared credentials without a password manager, 1Password's nonprofit pricing removes the cost objection entirely.

AWS and Azure credits — Both offer nonprofit programs beyond what's bundled in the productivity suites. Worth checking separately, particularly if you have any cloud infrastructure.

Most US-registered 501(c)(3)s qualify for these programs. The TechSoup verification process is the most involved step, but it's a one-time requirement that unlocks most of the others. Budget several weeks for verification before counting on access.

GitHub's free tier is more capable than most organizations realize, and eligible nonprofits can access GitHub Team at no cost. If you're running version control on anything — code, configuration, infrastructure-as-code, documentation — GitHub Free covers a significant portion of what most teams actually need.

GitHub Free for organizations includes:

• Unlimited public and private repositories with unlimited collaborators
• 2,000 GitHub Actions minutes per month — sufficient for most small-team CI/CD pipelines
• 500 MB of Packages storage
• GitHub Issues and Projects for lightweight project tracking
• Dependabot alerts for known vulnerabilities in your dependencies

GitHub Copilot Free — As of late 2024, GitHub offers a free tier of Copilot with 2,000 code completions and 50 chat messages per month, no credit card required. For organizations evaluating AI-assisted development before committing to a paid seat, this is a low-friction starting point. GitHub Copilot Business ($19/user/month) adds organization-wide policy controls and audit logs.

GitHub for Nonprofits — Registered 501(c)(3) organizations can apply for GitHub Team at no cost through GitHub's nonprofit program. GitHub Team (normally $4/user/month) adds protected branches, required reviewers, code owners, and 3,000 Actions minutes per month — meaningful upgrades for teams with any kind of review or deployment workflow. Apply through GitHub's nonprofit portal; verification typically takes a few business days.

Where it fits: if your organization manages any infrastructure as code — Terraform, Ansible, Bicep, or similar — GitHub is the natural home for it. Version control on infrastructure configuration is one of the highest-leverage practices an IT team can adopt, and the free tier removes the cost barrier entirely.