NIST CSF template · NIST CSF 2.0
Asset Management Policy
Identifying and managing organizational assets within the context of their relative importance to business objectives. (NIST CSF 2.0: IDENTIFY, ID.AM) Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 7
- Formats
- PDF, Word
- Shelf
- 10 NIST CSFdocuments in all
No card needed to start.
NIST CSF7 sections
Asset Management PolicyIdentifying and managing organizational assets within the context of their relative importance to business objectives. (NIST CSF 2.0: IDENTIFY, ID.AM)
- Cites
- ID.AM-1, ID.AM-2, ID.AM-5 and 4 more
- Formats
- PDF and Word
NIST CSF shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Asset Inventory Requirements
- Asset Classification
- Asset Ownership
- Asset Lifecycle Management
- Software Inventory and License Management
- Inventory Maintenance Schedule
Controls it cites
The NIST CSF controls first, then the matching controls in other frameworks.
- ID.AM-1Hardware InventoryNIST CSF
- ID.AM-2Software InventoryNIST CSF
- ID.AM-5Resource PrioritizationNIST CSF
- SOC 2 CC6.1Logical & Physical Access: Security SoftwareSOC 2
- SOC 2 CC6.5Logical & Physical Access: Asset DisposalSOC 2
- ISO A.8.1User Endpoint DevicesISO 27001
- HIPAA §164.310(d)(1)Device and Media ControlsHIPAA
- NIST CSF7 sections
Risk Assessment Policy
CitesID.RA-1 ID.RA-3 ID.RA-5 +5 +6PDF · WordCites ID.RA-1, Vulnerability Identification (NIST CSF); ID.RA-3, Threat Identification (NIST CSF); ID.RA-5, Risk Response (NIST CSF), and 5 more. - NIST CSF7 sections
Access Control Policy
CitesPR.AA-1 PR.AA-3 PR.AA-5 +5 +6PDF · WordCites PR.AA-1, Identity Management (NIST CSF); PR.AA-3, Remote Access (NIST CSF); PR.AA-5, Access Permissions (NIST CSF), and 5 more. - NIST CSF7 sections
Security Awareness & Training Policy
CitesPR.AT-1 SOC 2 CC1.4 SOC 2 CC2.2 +4 +5PDF · WordCites PR.AT-1, Awareness & Training (NIST CSF); SOC 2 CC1.4, COSO Principle 4: Competence Commitment (SOC 2); SOC 2 CC2.2, COSO Principle 14: Internal Communication (SOC 2), and 4 more. - NIST CSF7 sections
Data Security Policy
CitesPR.DS-1 PR.DS-2 PR.DS-5 +5 +6PDF · WordCites PR.DS-1, Data at Rest (NIST CSF); PR.DS-2, Data in Transit (NIST CSF); PR.DS-5, Data Leak Protection (NIST CSF), and 5 more. - NIST CSF7 sections
Anomaly & Event Detection Policy
CitesDE.AE-2 DE.AE-3 DE.CM-1 +4 +5PDF · WordCites DE.AE-2, Event Analysis (NIST CSF); DE.AE-3, Event Correlation (NIST CSF); DE.CM-1, Network Monitoring (NIST CSF), and 4 more. - NIST CSF7 sections
Continuous Monitoring Policy
CitesDE.CM-1 DE.CM-3 SOC 2 CC4.1 +5 +6PDF · WordCites DE.CM-1, Network Monitoring (NIST CSF); DE.CM-3, Personnel Monitoring (NIST CSF); SOC 2 CC4.1, COSO Principle 16: Monitoring Activities (SOC 2), and 5 more.
NIST CSF on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIST CSF + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.