TPN Readiness Checklist for a Small Post House

The Short Answer

Being ready for a TPN assessment means you can show, with documents and screenshots, that your shop meets the MPA Content Security Best Practices for the sites and services you put in scope. A small post house usually has most of the controls in someone's head and very little on paper. This checklist walks through what an assessor will ask to see, grouped the way the Best Practices are grouped.

One note on names first. In September 2025 TPN moved from two tiers to four: Blue, Silver, Gold and Gold Star. Our post TPN Shields Explained covers each tier in more detail. TPN also says plainly that a Shield is not an approval, certification or pass or fail. Each studio makes its own risk-based decision using TPN as a baseline.

Step Zero: Decide What Is In Scope

TPN asks you to describe your business operation, then add the sites and applications you want assessed. Your scope decides which controls you answer. A two-room edit shop with one office is a small scope. A shop that also runs its own web portal for client downloads has an application in scope as well. Settle this before you do anything else, because it changes the checklist.

TPN lets you create a free TPN+ account, fill in your profile and complete the self-assessment questionnaire before you pay for membership. That questionnaire is a free gap analysis, and finishing it earns a Blue Shield, although the Blue Shield is not visible to anyone until the membership fee is paid.

The Checklist

The control numbers below come from the current published Best Practices workbook. Items marked as Best Practices are the minimum; the document also lists Additional Recommendations that studios sometimes ask for on sensitive titles.

Paperwork

• A security policy or information security manual approved by leadership and reviewed on a schedule
• An acceptable use policy that says nobody posts anything about pre-release content on social media without written client consent
• A business continuity plan and a disaster recovery plan, with backups that are restricted from deletion and encrypted per client requirements
• A written risk assessment, repeated annually
• An incident response policy covering both IT incidents and content incidents (the incident plan outline is in our incident response post)
• A network diagram that shows segments, internet boundaries and the path client content takes

Network

• The content and production network separated from the office network by VLANs with access control lists, or by a physical air gap, with no machine bridging the two
• A stateful firewall that denies traffic by default, with a reviewed rule list and logs
• Wi-Fi set to WPA2-EAP or WPA3, a guest network that only reaches the internet, and wireless adapters disconnected from production computers
• Remote access through a VPN with split tunneling disabled and idle sessions ended after 15 minutes

If this section is your weak spot, network security for creative studios covers segmentation in more detail.

Systems and Accounts

• Unique usernames, multi-factor authentication on internet-facing systems and administrator access, and passphrases of at least 16 characters
• Least-privilege access, with no one running as local administrator without a reason
• USB and external storage blocked on machines that hold content, except on the designated content transfer system
• Screen lock after at most 15 minutes of inactivity
• Centrally managed endpoint protection
• A patching process that covers NAS units, switches and firewalls, not only laptops
• Vulnerability scans monthly for external addresses and quarterly (authenticated) for internal ones, and a penetration test every year
• AES-256 encryption for content at rest, and TLS 1.2 or better in transit

Content Handling

• A dedicated content transfer system with an approval step, kept apart from production and external networks
• Content deleted from the transfer system after 24 hours, or sooner if the client says so
• An asset tracking process with unique identifiers and logs kept for at least a year
• A procedure for high-security titles: aliases instead of real names, named people only, individual NDAs
• A destruction process for drives and paper, with the person who handles an asset kept separate from the person who destroys it

Physical

• Controlled entry points, a visitor log kept for a year, and verified ID for visitors to high-security areas
• Electronic access control with logs for rooms where content lives, plus an alarm and cameras covering entry points
• A key log for restricted rooms

People

• Background screening, onboarding and offboarding steps that cover employees, contractors and freelancers
• Security training at hire and every year, with a log of who attended
• A work-from-home policy if anyone cuts outside the building (see TPN for freelancers and remote editors)

Build the Evidence Folder

An assessor verifies your answers against evidence, so collect it as you go: the signed policies, the network diagram, firewall rule exports, a screenshot of MFA enforcement, patch reports, scan reports, visitor logs, training sign-in sheets and offboarding records. TPN+ lets you attach evidence to each question, and you can note compensating controls in the details box.

If you already hold an ISO 27001, SOC 2 Type 2 or CSA STAR certificate, TPN+ can pre-fill matching answers. The assessor still has to validate every control.

What Happens Next

You pick a TPN-accredited assessor from the directory, agree scope and price, and contract with them directly. Assessor fees are separate from TPN membership, and TPN recommends collecting more than one bid. Membership fees scale with annual revenue and are listed on TPN's membership page. Once the assessor accepts the request, TPN's process gives them 15 business days to submit. Almost every assessment produces findings. Submitting a remediation plan earns Silver. Closing the Best Practice items, reviewed by TPN, earns Gold.

TPN's own quick start guide suggests aiming for a first Shield within 90 days. That is a target, and your timeline depends on your starting point.

Want a person to help?

A real person on our team can run through this checklist with you, mark what is missing, and help you write the policies and fix the network pieces. We help you get ready. The assessment itself is done by an independent, TPN-accredited assessor, and we do not certify anyone or promise an outcome. See our TPN certification consulting or plug us in with a note about your setup.