Template Description

Information Security Policy Establishes the overarching security direction, principles, and
Template expectations for the organization, supporting NIST and ISO/IEC
requirements.

Risk Management Policy & Risk Defines the risk management approach and provides a structured register
Register Template for identifying, assessing, and tracking risks as required by NIST SP 800-37
and ISO/IEC 27001.

Asset Inventory & Classification Ensures all information assets are identified, classified, and managed in
Template accordance with NIST and ISO/IEC requirements.

Access Control Policy & User Access Defines access management principles and provides a checklist for
Review Checklist periodic user access reviews, supporting NIST AC controls and ISO/IEC
27001 Annex A.9.

Supplier Security Policy & Supplier Establishes requirements for managing supplier risks and provides a
List Template template for maintaining an approved supplier list, supporting NIST and
ISO/IEC 27001 A.15.

System Authorization & Security Documents the process for system authorization and ongoing security
Assessment Plan Template assessments, as required by NIST SP 800-37 and 800-53.

Continuous Monitoring Plan Defines the approach for ongoing monitoring of controls and risks,
Template supporting NIST SP 800-137 and ISO/IEC 27001 clause 9.
Incident Response Policy & Incident Establishes procedures for responding to security incidents and provides
Log Template a log template for evidence collection, supporting NIST IR controls and
ISO/IEC 27001 A.16.

Change Management Policy & Documents the process for managing changes to systems and controls,
Change Log Template ensuring traceability and compliance with NIST and ISO/IEC
requirements.

Training & Awareness Policy Defines requirements for security training and awareness, supporting
Template NIST AT controls and ISO/IEC 27001 clause 7.2.

Audit & Compliance Monitoring Outlines the approach for internal audits and compliance monitoring,
Policy Template supporting NIST and ISO/IEC 27001 clause 9.2.

Data Classification & Handling Policy Defines data classification levels and handling requirements, supporting
Template NIST and ISO/IEC 27001 A.8.

Vulnerability Management Policy & Documents the process for identifying, assessing, and remediating
Remediation Log Template vulnerabilities, supporting NIST RA and SI controls.

Backup & Recovery Policy Template Defines backup and recovery requirements to ensure data availability and
integrity, supporting NIST CP controls and ISO/IEC 27001 A.17.
Physical Security Policy Template Addresses physical security controls, even if out of scope for some
environments; includes placeholders where not applicable.

Document Control & Retention Establishes requirements for document management, versioning, and
Policy Template retention, supporting ISO/IEC 27001 clause 7.5.

Privacy & Data Protection Policy Defines privacy and data protection requirements, supporting NIST and
Template ISO/IEC 27701 where applicable.

Change Management Policy & Ensures changes to systems and processes are controlled and
Change Request Form documented, supporting NIST and ISO/IEC 27001 A.12.1.2.

Audit & Compliance Review Policy & Defines the process for conducting internal audits and compliance
Audit Checklist reviews, supporting NIST and ISO/IEC 27001 clause 9.2.

Business Continuity & Disaster Documents the approach to business continuity and disaster recovery,
Recovery Policy supporting NIST SP 800-34 and ISO/IEC 27001 A.17.
When to Use Sections (H1s)
Use when establishes the overarching security Information Security Policy • Purpose • Scope • Roles
direction, principles, and expectations for the & Responsibilities • Procedure / Method • Records &
organization, supporting NIST and ISO/IEC Evidence (forms/logs to keep) • KPIs & Effectiveness
requirements. Monitoring • References • Document Control

Use when defines the risk management approach and Risk Management Policy • Purpose • Scope • Roles &
provides a structured register for identifying, Responsibilities • Procedure / Method • Records &
assessing, and tracking risks as required by NIST SP Evidence (forms/logs to keep) • KPIs & Effectiveness
800-37 and ISO/IEC 27001. Monitoring • References • Document Control • Risk
Register Example

Use when ensures all information assets are Asset Inventory & Classification Policy • Purpose •
identified, classified, and managed in accordance with Scope • Roles & Responsibilities • Procedure / Method
NIST and ISO/IEC requirements. • Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control • Asset Inventory Example

Use when defines access management principles and Access Control Policy • Purpose • Scope • Roles &
provides a checklist for periodic user access reviews, Responsibilities • Procedure / Method • Records &
supporting NIST AC controls and ISO/IEC 27001 Annex Evidence (forms/logs to keep) • KPIs & Effectiveness
A.9. Monitoring • References • Document Control • User
Access Review Checklist

Use when establishes requirements for managing Supplier Security Policy • Purpose • Scope • Roles &
supplier risks and provides a template for maintaining Responsibilities • Procedure / Method • Records &
an approved supplier list, supporting NIST and Evidence (forms/logs to keep) • KPIs & Effectiveness
ISO/IEC 27001 A.15. Monitoring • References • Document Control •
Supplier List Example

Use when documents the process for system System Authorization & Security Assessment Plan •
authorization and ongoing security assessments, as Purpose • Scope • Roles & Responsibilities •
required by NIST SP 800-37 and 800-53. Procedure / Method • Records & Evidence (forms/logs
to keep) • KPIs & Effectiveness Monitoring •
References • Document Control

Use when defines the approach for ongoing Continuous Monitoring Plan • Purpose • Scope •
monitoring of controls and risks, supporting NIST SP Roles & Responsibilities • Procedure / Method •
800-137 and ISO/IEC 27001 clause 9. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control
Use when establishes procedures for responding to Incident Response Policy • Purpose • Scope • Roles &
security incidents and provides a log template for Responsibilities • Procedure / Method • Records &
evidence collection, supporting NIST IR controls and Evidence (forms/logs to keep) • KPIs & Effectiveness
ISO/IEC 27001 A.16. Monitoring • References • Document Control •
Incident Log Example

Use when documents the process for managing Change Management Policy • Purpose • Scope •
changes to systems and controls, ensuring traceability Roles & Responsibilities • Procedure / Method •
and compliance with NIST and ISO/IEC requirements. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control • Change Log Example

Use when defines requirements for security training Training & Awareness Policy • Purpose • Scope •
and awareness, supporting NIST AT controls and Roles & Responsibilities • Procedure / Method •
ISO/IEC 27001 clause 7.2. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control

Use when outlines the approach for internal audits Audit & Compliance Monitoring Policy • Purpose •
and compliance monitoring, supporting NIST and Scope • Roles & Responsibilities • Procedure / Method
ISO/IEC 27001 clause 9.2. • Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control

Use when defines data classification levels and Data Classification & Handling Policy • Purpose •
handling requirements, supporting NIST and ISO/IEC Scope • Roles & Responsibilities • Procedure / Method
27001 A.8. • Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control

Use when documents the process for identifying, Vulnerability Management Policy • Purpose • Scope •
assessing, and remediating vulnerabilities, supporting Roles & Responsibilities • Procedure / Method •
NIST RA and SI controls. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control • Remediation Log Example

Use when defines backup and recovery requirements Backup & Recovery Policy • Purpose • Scope • Roles
to ensure data availability and integrity, supporting & Responsibilities • Procedure / Method • Records &
NIST CP controls and ISO/IEC 27001 A.17. Evidence (forms/logs to keep) • KPIs & Effectiveness
Monitoring • References • Document Control
Use when addresses physical security controls, even if Physical Security Policy • Purpose • Scope • Roles &
out of scope for some environments; includes Responsibilities • Procedure / Method • Records &
placeholders where not applicable. Evidence (forms/logs to keep) • KPIs & Effectiveness
Monitoring • References • Document Control

Use when establishes requirements for document Document Control & Retention Policy • Purpose •
management, versioning, and retention, supporting Scope • Roles & Responsibilities • Procedure / Method
ISO/IEC 27001 clause 7.5. • Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control

Use when defines privacy and data protection Privacy & Data Protection Policy • Purpose • Scope •
requirements, supporting NIST and ISO/IEC 27701 Roles & Responsibilities • Procedure / Method •
where applicable. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control

Use when ensures changes to systems and processes Change Management Policy • Purpose • Scope •
are controlled and documented, supporting NIST and Roles & Responsibilities • Procedure / Method •
ISO/IEC 27001 A.12.1.2. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control • Change Request Form Example

Use when defines the process for conducting internal Audit & Compliance Review Policy • Purpose • Scope •
audits and compliance reviews, supporting NIST and Roles & Responsibilities • Procedure / Method •
ISO/IEC 27001 clause 9.2. Records & Evidence (forms/logs to keep) • KPIs &
Effectiveness Monitoring • References • Document
Control • Audit Checklist Example

Use when documents the approach to business Business Continuity & Disaster Recovery Policy •
continuity and disaster recovery, supporting NIST SP Purpose • Scope • Roles & Responsibilities •
800-34 and ISO/IEC 27001 A.17. Procedure / Method • Records & Evidence (forms/logs
to keep) • KPIs & Effectiveness Monitoring •
References • Document Control