diff --git a/README.md b/README.md
index f3dbf6c..8e839fd 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,21 @@
-This repo requires pre-commit hooks installed. See the [instructions](https://github.com/uktrade/github-standards/blob/main/README.md#usage) for information of how to install these
+# uktrade/.github
+
+This is the [`.github` repository](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file) for the [`uktrade`](https://github.com/uktrade) organisation. It holds organisation-wide defaults that GitHub applies automatically to any `uktrade` repository that does not define its own.
+
+## What's here
+
+| Path | Purpose |
+|---|---|
+| [`SECURITY.md`](SECURITY.md) | DBT GitHub Security Policy — inherited by every repository without its own `SECURITY.md` |
+| [`.github/pull_request_template.md`](.github/pull_request_template.md) | Default pull request template |
+| [`templates/SECURITY_CHECKLIST.md`](templates/SECURITY_CHECKLIST.md) | Security checklist to copy into a repository root |
+| [`workflow-templates/`](workflow-templates/) | Organisation [workflow templates](https://docs.github.com/en/actions/using-workflows/creating-starter-workflows-for-your-organization) offered when creating a new Action |
+| [`docs/`](docs/) | Step-by-step setup guides referenced from the security policy |
+
+## Contributing
+
+Changes here affect every `uktrade` repository, so raise a PR against this repo rather than copying files elsewhere.
+
+This repo requires the organisation-approved pre-commit hooks. See the [github-standards instructions](https://github.com/uktrade/github-standards/blob/main/README.md#usage) to install them.
+
+The code security diagram (`assets/code_sec_workflow.excalidraw.svg`) is an SVG with the [Excalidraw](https://excalidraw.com/) scene embedded inside it, so it renders as a plain image in `SECURITY.md` while staying editable. Edit it with the [Excalidraw VS Code extension](https://marketplace.visualstudio.com/items?itemName=pomdtr.excalidraw-editor), which reads and writes the embedded scene directly.
diff --git a/SECURITY.md b/SECURITY.md
index d25e879..ae4af21 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,193 +1,211 @@
-# SECURITY.md
+# DBT GitHub Security Policy
-## Summary
-This policy explains how the public can responsibly [report vulnerabilities](reporting-a-vulnerability), and how DBT developers must protect [sensitive information](handling-secrets) and follow DBT’s required [security controls](security-controls) when working in GitHub.
+## Summary
+
+This policy explains:
+- how members of the public can responsibly [report vulnerabilities](#reporting-a-vulnerability) to the Department for Business and Trade (DBT)
+- how DBT developers can follow [secure development practices](#secure-development-practices)
+- how DBT developers can apply DBT's required [security controls](#security-controls) in GitHub
---
## Reporting a Vulnerability
-If you believe you have found a security vulnerability, please submit a report via our HackerOne [form](https://hackerone.com/2680e4cd-0436-42a5-bd2a-37fd86367276/embedded_submissions/new)
+This section is for members of the public and external security researchers. DBT staff should instead report vulnerabilities directly to the Cyber Security team.
+
+If you believe you have found a security vulnerability, please submit a report via our [HackerOne form](https://hackerone.com/2680e4cd-0436-42a5-bd2a-37fd86367276/embedded_submissions/new).
Please include:
-- Where the issue can be observed (URL, IP address or page)
-- A brief description (e.g. “XSS vulnerability”)
-- Safe, non‑destructive reproduction steps
+- Where the issue can be observed (URL, IP address or page)
+- A brief description (e.g. “XSS vulnerability”)
+- Safe, non-destructive reproduction steps
+
+**Scope**
+- In scope: digital services operated by DBT, including repositories in the [`uktrade` GitHub organisation](https://github.com/uktrade)
+- Out of scope: denial of service, social engineering, physical attacks, and reports from automated scanners without a working proof of concept
**Disclosure guidelines**
-- Do **not** share vulnerability details beyond DBT and the asset owner
-- HackerOne accounts are optional but allow updates
-- You must agree to HackerOne’s Terms, Privacy Policy, and Disclosure Guidelines
-- NCC Group triages reports within **five working days**
-- DBT Cyber assists with coordination, but the asset owner is responsible for remediation
+- Do **not** share vulnerability details beyond DBT and the asset owner
+- HackerOne accounts are optional, but allow you to receive updates on your report
+- You must agree to HackerOne’s Terms, Privacy Policy, and Disclosure Guidelines
+- DBT’s Cyber Security team assists with coordination, but the asset owner is responsible for remediation
+
+**Safe harbour**
+
+DBT will not seek prosecution of researchers who act in good faith: stay within the scope above, avoid destructive testing, and do not access, modify or retain other users’ data.
---
-## Handling Secrets
+## Secure Development Practices
-These requirements apply to DBT developers.
+These requirements apply to all DBT developers.
-Information on secrets and their management can be found [here](https://dbis.sharepoint.com/:w:/r/sites/DDaTDirectorate/Shared%20Documents/Work%20-%20GitHub%20Security/Github%20Security%20Framework/Guidelines%20and%20Policies/GitHub%20Security%20Standards%20v0.6.docx?d=w022dea8105074e36af5450797083c297&csf=1&web=1&e=SR5out).
+### Handling Secrets and Sensitive Data
-Instructions on what to do in the event of a leak can be found [here](https://dbis.sharepoint.com/:w:/r/sites/DDaTDirectorate/Shared%20Documents/Work%20-%20GitHub%20Security/Github%20Security%20Framework/Incident%20Response/GitHub%20Repository%20Incident%20Playbook.docx?d=w9ba04ffa4a7c4ff38faaaf12ff030c94&csf=1&web=1&e=yZF5dO).
+Leaked secrets (API keys, tokens, passwords) are among the most common causes of security breaches, and personal or otherwise sensitive data must be kept out of GitHub just as carefully. Sensitive data includes operational details — such as internal hostnames, IP ranges and security thresholds — that would make DBT systems easier to attack. Developers must:
-**In summary, developers must:**
-- Never commit secrets or sensitive data to GitHub
+- Never commit secrets or sensitive data to GitHub
- Use secure storage for managing secrets
-- Ensure no secrets appear in PRs, logs or config files
-- Follow incident‑response steps immediately if a leak occurs
+- Ensure no secrets or sensitive data appear in pull requests (PRs), logs or config files
----
+The [GitHub Security Standards](https://dbis.sharepoint.com/:w:/r/sites/DDaTDirectorate/Shared%20Documents/Work%20-%20GitHub%20Security/Github%20Security%20Framework/Guidelines%20and%20Policies/GitHub%20Security%20Standards%20v0.6.docx?d=w022dea8105074e36af5450797083c297&csf=1&web=1&e=SR5out) (DBT staff access only) explain what counts as a secret and how to manage secrets securely.
-## Security Controls
+If a secret or sensitive data is pushed to GitHub follow the [GitHub Repository Incident Playbook](https://dbis.sharepoint.com/:w:/r/sites/DDaTDirectorate/Shared%20Documents/Work%20-%20GitHub%20Security/Github%20Security%20Framework/Incident%20Response/GitHub%20Repository%20Incident%20Playbook.docx?d=w9ba04ffa4a7c4ff38faaaf12ff030c94&csf=1&web=1&e=yZF5dO) (DBT staff access only)
-DBT uses several processes to strengthen the security posture of our GitHub repositories.
+### Handling Vulnerabilities
-Use this checklist to ensure your repository implements these processes:
+Vulnerabilities can enter through your own code or through the dependencies it relies on. Several GitHub scans guard against them:
-- [ ] **Create or update `SECURITY_CHECKLIST.md`**
- See: [SECURITY_CHECKLIST.md](#security_checklistmd)
+- [CodeQL](https://docs.github.com/en/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning-with-codeql) analyses your own code, both on pull requests and on a scheduled basis
+- [Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) flags vulnerable dependencies already in your project, and [Dependabot security updates](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates) raise PRs to fix them automatically
+- [Dependency review](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review) flags vulnerable dependencies a pull request would add before it is merged
-- [ ] **Review the CI/CD overview**
- See: [CI/CD Overview](#cicd-overview)
+We are also investigating IDE scanning and non-GitHub native code security scanning solutions.
-- [ ] **Set up the pre‑commit hook framework**
- See: [Pre‑Commit Hooks](#precommit-hooks)
+Any alerts these scans raise must be triaged, not ignored. Fix the vulnerability, or dismiss the alert with a documented reason (e.g. false positive, not exploitable in this context)
-- [ ] **Set up custom GitHub properties**
- See: [Custom GitHub Properties](#custom-github-properties)
+Alerts must be resolved — fixed or dismissed with a reason — within the timescales provided in the [Vulnerability Management Policy](https://static.workspace.trade.gov.uk/documents/CYB.07_-_Vulnerability_Management_Policy_-_v.1.0_20251127162547.pdf) (DBT staff access only).
-- [ ] **Apply the DBT GitHub security policy**
- See: [GitHub Security Policy](#github-security-policy)
+Do not discuss unfixed vulnerability details anywhere public — vulnerability alerts are visible only to users with write access, but comments on PRs and issues in public repositories are visible to everyone.
-- [ ] **Ensure a `CODEOWNERS` file exists**
- See: [CODEOWNERS](#codeowners)
+### Bypassing Security Controls
-- [ ] **Review GitHub Safety Tips**
- See: [GitHub Safety Tips](#github-safety-tips)
+Some GitHub security controls can be bypassed by repository or organisation administrators. This should only happen in exceptional circumstances and not as a substitute for fixing security issues.
-- [ ] **Review Repository Access and Governance**
- See: [Repository Access & Governance](#repository-access--governance)
+When a control is bypassed:
-- [ ] **Review the Pull Request template**
- See: [Pull Request Template](#pull-request-template)
+- The justification must be documented as a comment on the PR
+- Any resulting security risk must be understood and accepted
+- Follow-up remediation work should be tracked and completed
+
+---
-- [ ] **Review branch protection rules**
- See: [Branch Protection Rules](#branch-protection-rules)
+## Security Controls
-- [ ] **Review push protection**
- See: [Push Protection](#push-protection)
+DBT uses several processes to strengthen the security posture of our GitHub repositories. The diagram below shows where some of these controls apply as code moves from your workspace to GitHub, following the secure development lifecycle principle of “shifting left” — catching issues at the earliest possible point.
----
+
-### SECURITY_CHECKLIST.md
+### Security Checklist
-Create `SECURITY_CHECKLIST.md` in the root of your repository if not present. Copy the checklist and update it as checks are completed.
+The security checklist turns those controls into concrete steps to confirm for your own repository. Copy [`SECURITY_CHECKLIST.md`](https://github.com/uktrade/.github/blob/main/templates/SECURITY_CHECKLIST.md) into your repository root and work through it from top to bottom, ticking each item once you have confirmed it. Its items follow the same order as the detailed guidance below, and each says who can action it. The result is a visible record of your repository's security posture for your team, reviewers and auditors. The Security Checklist must be refreshed at least once a year, using up-to-date documentation and noting the date last checked.
---
-### CI/CD Overview
+### Contributor Controls
-Review the GitHub CI/CD Overview which summarises the controls DBT has in place to strengthen the security posture of our GitHub repositories.
+Actions each contributor takes for themselves.
-
+#### Security Training
----
+All internal contributors must have completed the following free courses in the last year. Download the certificates where applicable. Choose the language that you are most familiar with.
-### Pre‑Commit Hooks
+| Course | Time | Notes |
+|---|---|---|
+| [Snyk Learn hardcoded secrets lesson](https://learn.snyk.io/lesson/hardcoded-secrets/) | ~20mins | Reinforces the Handling Secrets and Sensitive Data requirements above |
+| [Snyk Learn: Security for Developers](https://learn.snyk.io/learning-paths/security-for-developers/) | ~4 hrs | 16 lessons going deeper into specific attack techniques (injection variants, SSRF, prototype pollution etc.) |
-DBT requires all contributors to use the organisation‑approved pre‑commit hooks before committing. A GitHub Action blocks PRs where the hook has not run.
+For those who want to go further, the [PortSwigger Web Security Academy](https://portswigger.net/web-security) offers free, in-depth hands-on labs across the full range of web vulnerabilities.
-For more information and setup guidance please refer [here](https://github.com/uktrade/github-standards).
+#### GitHub Safety Tips
+
+Internal contributors should review the [GitHub Safety Tips](https://uktrade.atlassian.net/wiki/x/n4AEKQE) (DBT staff access only) to understand how to protect themselves when coding in the open.
---
-### Custom GitHub Properties
+### Repository-Level Controls
-DBT uses custom github properties to enforce branch protection rules and run organisation level github actions.
+Defences set up within the repository itself.
-Manage custom properties:
-`https://github.com/uktrade/REPO_NAME/settings/access`
+#### Pre-Commit Hooks
-**Mandatory**
-- `reusable_workflow_opt_in` - `true`
-- `scs_portfolio` - The portfolio associated with your CSC. If your portfolio is missing, this can be added by raising an SRE ticket.
+Repositories must include a `.pre-commit-config.yaml` that runs the organisation-approved [pre-commit](https://pre-commit.com/) hooks, and each contributor must install them locally. The hooks use [Trufflehog](https://github.com/trufflesecurity/trufflehog) to detect secrets and [Presidio](https://microsoft.github.io/presidio/) to detect sensitive data. They run on your machine before a commit is even created — the earliest and cheapest point to stop a leak, since anything that reaches GitHub must be treated as compromised.
-**Optional**
-- `is_docker` — for repos that build Docker images
-- `language` — all languages used by this repository should be selected, and github workflows will run with dedicated checks on that language.
+As a backstop, a GitHub Actions workflow (applied via the repository's custom properties) re-runs the same scans and blocks any PR where the pre-commit hooks were skipped locally.
----
+For more information and setup guidance, see the [uktrade/github-standards](https://github.com/uktrade/github-standards) repository.
-### GitHub Security Policy
+#### Repository access
-DBT has introduced a new organisation-wide GitHub security policy that applies the required security checks to every repository. New repositories get this policy by default, but existing ones must have it enabled before they can be made public. Over time, this policy will fully replace the old one across the uktrade account.
+Review repository access and ensure all users have the appropriate level of permission. Access must be granted through GitHub teams and not directly to individual users.
-**You must be an organisation administrator to apply this policy**
+Review people with **Admin** permissions to ensure access is justified, as this role can modify repository settings, manage access, and bypass certain repository controls.
-To add the new security policy, follow these instructions:
+If a user no longer requires access, they must be removed from the relevant team by contacting the SRE team or raising a PR against the [`uktrade/terraform-github`](https://github.com/uktrade/terraform-github) repository.
-1. As an organisation administrator, navigate to the [security config page](https://github.com/organizations/uktrade/settings/security_products).
-1. Scroll down to the **Apply configurations** sections, and enter the name of the repository to be made public in the filter input field
-1. Use the checkbox next to the results list to select all repositories being made public, then use the **Apply configuration** button to select the **Default DBT security** configuration
-1. A confirmation modal will appear displaying a summary of the action being made. Click the apply button
-1. In the repository that has had the new policy applied, navigate to the **Advanced Security** page in the repository settings. At the top of the page there should be a banner message **Modifications to some settings have been blocked by organization administrators.**
+#### CODEOWNERS
----
+Repositories must include a [`CODEOWNERS`](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) file. GitHub automatically requests a review from the listed owners when a PR touches their code, ensuring changes are seen by people who understand their security implications.
-### CodeQL for Fork‑Based PRs (Optional)
+#### Pull Request Template
-The default DBT GitHub Security policy does not currently support scanning PRs raised from a fork of a repository.
-If PRs from forks must be supported, switch to **Advanced** CodeQL to generate a `codeql.yml` workflow:
+A [pull request template](https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/creating-a-pull-request-template-for-your-repository) pre-fills the PR description with a standard checklist. PR review is the last human check before code is published, so the [DBT template](https://github.com/uktrade/.github/blob/main/.github/pull_request_template.md) prompts reviewers to look for secrets explicitly rather than relying on automated scanning alone.
-1. Open the GitHub settings page, and navigate to the Advanced Security section using the left hand menu
-1. Scroll down to the Code Scanning section, under the Tools sub-section there will be an item for CodeQL analysis
-1. Click the ... button next to Default setup text, then choose the Switch to advanced option from the menu
-1. On the popup, click the Disable CodeQL button. Although you are disabling CodeQL, there is still a branch protection rule in place that blocks a PR unless a CodeQL scan is detected. Disabling here will not allow PRs to be merged
-1. The GitHub online editor will open to create a new file called codeql.yml in your repo, and the contents of this file will be prefilled with the languages CodeQL has detected in your repo. You can modify the contents of this file if needed, however you must leave the workflow name as `CodeQL Advanced`
-1. Once happy with the workflow file contents, click the green Commit changes button to trigger a PR to merge this into the main branch
-1. Approve and merge the PR with this workflow file. Once merged, the CodeQL scan will perform an initial scan that can take a while but you can track the progress by viewing the Actions tab for your repository
+If your repository does not already contain a `pull_request_template.md` file, you will inherit the DBT template as a [community health file](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file). If you are already using your own template, copy its Reviewer Checklist section across so reviewers are still reminded to check for exposed secrets:
-### CODEOWNERS
+```
+## Reviewer Checklist
-Repositories must include a `CODEOWNERS` file:
-https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+- [ ] I have reviewed the PR and ensured no secret values are present
+```
-### GitHub Safety Tips
+#### Custom GitHub Properties
-Internal contributors should review the [GitHub Safety Tips](https://uktrade.atlassian.net/wiki/x/n4AEKQE) to understand how to protect themselves when coding in the open.
+DBT uses [custom GitHub properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) to enforce branch protection rules and run organisation-level GitHub Actions workflows. They describe what kind of repository this is, so the organisation's automation can apply the checks relevant to it — if they are missing or wrong, your repository may not get the right protections.
-### Repository Access & Governance
+View or set custom properties under **Settings → Custom properties**:
+`https://github.com/uktrade/REPO_NAME/settings/custom-properties`
-TBC
+**Mandatory**
+- `reusable_workflow_opt_in` — set to `true`
+- `scs_portfolio` — the portfolio associated with your Senior Civil Servant (SCS). If your portfolio is missing, this can be added by raising a ticket with the SRE team
-### Pull Request Template
+**Optional**
+- `is_docker` — for repositories that build Docker images
+- `language` — select all languages used by the repository, so the organisation-level workflows run language-specific checks
-If your repository does not already contain a pull_request_template.md file, you will inherit the DBT template by default. If you are already using your own template, you should add this section to remind reviewers they should be ensuring no secret values are visible:
+#### CodeQL for Fork-Based PRs (Optional)
-```
-### Reviewer Checklist
+The DBT GitHub security configuration does not currently support scanning PRs raised from a fork of a repository. Fork PRs typically come from contributors outside the organisation, so leaving them unscanned would create a gap in coverage.
-- [ ] I have reviewed the PR and ensured no secret or sensitive data is present
-```
+If PRs from forks must be supported, switch to [**Advanced** CodeQL](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) — follow the [step-by-step instructions](https://github.com/uktrade/.github/blob/main/docs/codeql-advanced-setup.md).
+
+---
+
+### Organisation-Applied Controls
+
+An organisation administrator applies these centrally, and they cannot be weakened at repository level. Verify they are active rather than configuring them yourself.
-### Branch Protection Rules
+#### GitHub Security Configuration
-An organisation ruleset has been created to apply a minimum set of branch protection rules:
+DBT has introduced an organisation-wide GitHub [security configuration](https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/establish-complete-coverage/apply-custom-configuration) that applies the required security checks to every repository. New repositories get this configuration by default, but existing ones must have it enabled before they can be made public. Over time, it will fully replace the old configuration across the `uktrade` organisation.
-- A PR is required for merges into the default branch (usually main)
+An organisation administrator must apply it — follow the [step-by-step instructions](https://github.com/uktrade/.github/blob/main/docs/github-security-configuration.md).
+
+#### Branch Protection Rules
+
+Branch protection stops unreviewed code reaching the default branch — the version of the code that gets deployed and that others build on. An organisation [ruleset](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) has been created to apply a minimum set of branch protection rules:
+
+- A PR is required for merges into the default branch (usually `main`)
- At least 1 approver is required before a PR can be merged
- Any conversations on the PR must be marked as resolved
-Organisation admins and repository admins have been added to the bypass list for this branch protection ruleset.
+Confirm the default branch protection policy ruleset is applied under Settings → Rules → Rulesets.
+
+Repository administrators may add additional rules to their own repositories, but cannot weaken the organisation ruleset: where rules overlap, the most restrictive rule applies. For example, a repository ruleset that drops the required number of approvers to 0 would have no effect, while one that raises it to 3 would apply.
-Repository admins might decide to add additional rules to their own repositories. It is not possible for repository admins to add their own rules that reduce this level of protection. As an example, a repository admin could add a ruleset that drops the required number of approvers to 0 but that would have no effect as the organisation ruleset would take precedence. They could add a ruleset that sets the number of approvers to 3, and as this is not reducing the organisation ruleset protection this would take precedence.
+#### GitHub Secret Protection
-## Push Protection
+The DBT GitHub security configuration enables two complementary features. [Push protection](https://docs.github.com/en/code-security/concepts/secret-security/push-protection) blocks pushes containing high-confidence secret formats, stopping them before they reach the repository's history. [Secret scanning](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning) covers a broader range, detecting secrets already committed and raising alerts in the **Security** tab. Both can apply [custom patterns](https://docs.github.com/en/code-security/how-tos/secure-your-secrets/customize-leak-detection/define-custom-patterns) for DBT-specific secrets.
-Push protection is required for all repositories using the default DBT GitHub security policy.
-DBT also defines [custom secret‑scanning patterns](https://docs.github.com/en/code-security/concepts/secret-security/about-push-protection).
+Confirm both features are enabled for your repository under Settings → Advanced Security → Secret Protection. If you need additional custom patterns, raise a ticket with the SRE team.
+
+#### Vulnerability Scanning
+
+The DBT GitHub security configuration and rulesets also enables the features described under [Handling Vulnerabilities](#handling-vulnerabilities) — CodeQL, Dependabot, Dependabot security updates and dependency review. Confirm these are active on your repository.
+
+---
-You should confirm that push protection is enabled on your repository.
+## About This Policy
-Please raise a ticket with SRE if you need additional patterns.
+The [DBT GitHub Security Policy](https://github.com/uktrade/.github/blob/main/SECURITY.md) is defined as a [community health file](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file), so every `uktrade` repository without its own `SECURITY.md` inherits it automatically. Do not add a `SECURITY.md` to your own repository — to suggest changes, raise a PR against the [`.github` repository](https://github.com/uktrade/.github) instead.
diff --git a/assets/CI-CD pipeline.svg b/assets/CI-CD pipeline.svg
deleted file mode 100644
index ba382fd..0000000
--- a/assets/CI-CD pipeline.svg
+++ /dev/null
@@ -1 +0,0 @@
-
\ No newline at end of file
diff --git a/assets/code_sec_workflow.excalidraw.svg b/assets/code_sec_workflow.excalidraw.svg
new file mode 100644
index 0000000..c5ea6d1
--- /dev/null
+++ b/assets/code_sec_workflow.excalidraw.svg
@@ -0,0 +1,2 @@
+
\ No newline at end of file
diff --git a/docs/codeql-advanced-setup.md b/docs/codeql-advanced-setup.md
new file mode 100644
index 0000000..0116502
--- /dev/null
+++ b/docs/codeql-advanced-setup.md
@@ -0,0 +1,11 @@
+# Setting Up Advanced CodeQL for Fork-Based PRs
+
+These instructions support the [CodeQL for Fork-Based PRs](https://github.com/uktrade/.github/blob/main/SECURITY.md#codeql-for-fork-based-prs-optional) control in the DBT GitHub Security Policy. Switching to [**Advanced** CodeQL](https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning) generates a `codeql.yml` workflow:
+
+1. Navigate to **Settings → Advanced Security** in your repository
+1. Scroll down to the **Code scanning** section; under the **Tools** sub-section there will be an item for CodeQL analysis
+1. Click the **...** button next to the **Default** setup text, then choose **Switch to advanced** from the menu
+1. On the popup, click the **Disable CodeQL** button. This only disables the *default* CodeQL setup — a branch protection rule remains in place that blocks PRs unless a CodeQL scan is detected, so PRs still cannot be merged without the advanced workflow you create in the next step
+1. GitHub will then open its online editor to create a new file called `codeql.yml`, prefilled with the languages CodeQL has detected in your repository. You can modify the contents of this file if needed, however you must leave the workflow name as `CodeQL Advanced`
+1. Once happy with the workflow file contents, click the green **Commit changes** button to trigger a PR to merge this into the default branch
+1. Approve and merge the PR with this workflow file. Once merged, CodeQL will perform an initial scan that can take a while; you can track the progress in the **Actions** tab for your repository
diff --git a/docs/github-security-configuration.md b/docs/github-security-configuration.md
new file mode 100644
index 0000000..c8b5095
--- /dev/null
+++ b/docs/github-security-configuration.md
@@ -0,0 +1,11 @@
+# Applying the DBT GitHub Security Configuration
+
+These instructions support the [GitHub Security Configuration](https://github.com/uktrade/.github/blob/main/SECURITY.md#github-security-configuration) control in the DBT GitHub Security Policy.
+
+**You must be an organisation administrator to apply this configuration**
+
+1. As an organisation administrator, navigate to the [security configurations page](https://github.com/organizations/uktrade/settings/security_products)
+1. Scroll down to the **Apply configurations** section, and enter the name of the repository to be made public in the filter input field
+1. Use the checkbox next to the results list to select all repositories being made public, then use the **Apply configuration** button to select the **Default DBT security** configuration
+1. A confirmation modal will appear displaying a summary of the action being made. Click the **Apply** button
+1. To confirm the configuration has been applied, navigate to **Settings → Advanced Security** in the repository. At the top of the page there should be a banner message **Modifications to some settings have been blocked by organization administrators**
diff --git a/templates/SECURITY_CHECKLIST.md b/templates/SECURITY_CHECKLIST.md
new file mode 100644
index 0000000..9765196
--- /dev/null
+++ b/templates/SECURITY_CHECKLIST.md
@@ -0,0 +1,33 @@
+# Security Checklist
+
+Work through this checklist from top to bottom, ticking each item once you have confirmed it is true. Each item links to detailed guidance in the [DBT GitHub Security Policy](https://github.com/uktrade/.github/blob/main/SECURITY.md).
+
+Last checked against the policy: _add date_
+
+## 1. Contributor controls
+
+Actions each contributor takes for themselves, so everyone knows what the controls are and why they exist.
+
+- [ ] [All internal contributors have read the DBT GitHub Security Policy](https://github.com/uktrade/.github/blob/main/SECURITY.md)
+- [ ] [All internal contributors have completed code security training in the last year](https://github.com/uktrade/.github/blob/main/SECURITY.md#security-training)
+- [ ] [All internal contributors have reviewed the GitHub Safety Tips on coding in the open](https://github.com/uktrade/.github/blob/main/SECURITY.md#github-safety-tips)
+
+## 2. Repository-level controls
+
+Defences set up within the repository itself.
+
+- [ ] [A `.pre-commit-config.yaml` file exists so the organisation-approved hooks run before commits](https://github.com/uktrade/.github/blob/main/SECURITY.md#pre-commit-hooks)
+- [ ] [Repository access has been reviewed](https://github.com/uktrade/.github/blob/main/SECURITY.md#repository-access)
+- [ ] [A `CODEOWNERS` file exists so the right people review changes](https://github.com/uktrade/.github/blob/main/SECURITY.md#codeowners)
+- [ ] [The pull request template reminds reviewers to check for secrets](https://github.com/uktrade/.github/blob/main/SECURITY.md#pull-request-template)
+- [ ] [The mandatory custom GitHub properties are set](https://github.com/uktrade/.github/blob/main/SECURITY.md#custom-github-properties)
+- [ ] [Advanced CodeQL is set up if the repository accepts PRs from forks (optional)](https://github.com/uktrade/.github/blob/main/SECURITY.md#codeql-for-fork-based-prs-optional)
+
+## 3. Organisation-applied controls
+
+Controls applied by an organisation administrator and verified by a repository administrator.
+
+- [ ] [The DBT GitHub security configuration is applied to the repository](https://github.com/uktrade/.github/blob/main/SECURITY.md#github-security-configuration)
+- [ ] [The default branch protection ruleset is applied to the default branch](https://github.com/uktrade/.github/blob/main/SECURITY.md#branch-protection-rules)
+- [ ] [GitHub Secret Protection is enabled and blocking secrets](https://github.com/uktrade/.github/blob/main/SECURITY.md#github-secret-protection)
+- [ ] [The relevant vulnerability scans are active](https://github.com/uktrade/.github/blob/main/SECURITY.md#vulnerability-scanning)