NIST CSF template · NIST CSF 2.0
Security Awareness & Training Policy
Personnel and partners are provided with cybersecurity awareness education. (NIST CSF 2.0: PROTECT, PR.AT) Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 7
- Formats
- PDF, Word
- Shelf
- 10 NIST CSFdocuments in all
No card needed to start.
NIST CSF7 sections
Security Awareness & Training PolicyPersonnel and partners are provided with cybersecurity awareness education. (NIST CSF 2.0: PROTECT, PR.AT)
- Cites
- PR.AT-1, SOC 2 CC1.4, SOC 2 CC2.2 and 4 more
- Formats
- PDF and Word
NIST CSF shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Core Training Curriculum
- Onboarding Training
- Annual Refresher Training
- Role-Based Specialized Training
- Phishing Simulation Program
- Training Records and Metrics
Controls it cites
The NIST CSF controls first, then the matching controls in other frameworks.
- PR.AT-1Awareness & TrainingNIST CSF
- SOC 2 CC1.4COSO Principle 4: Competence CommitmentSOC 2
- SOC 2 CC2.2COSO Principle 14: Internal CommunicationSOC 2
- ISO A.6.3Information Security Awareness & TrainingISO 27001
- HIPAA §164.308(a)(5)Security Awareness & TrainingHIPAA
- HIPAA §164.530(b)TrainingHIPAA
- PCI DSS Req. 12Security PoliciesPCI DSS
- NIST CSF7 sections
Data Security Policy
CitesPR.DS-1 PR.DS-2 PR.DS-5 +5 +6PDF · WordCites PR.DS-1, Data at Rest (NIST CSF); PR.DS-2, Data in Transit (NIST CSF); PR.DS-5, Data Leak Protection (NIST CSF), and 5 more. - NIST CSF7 sections
Anomaly & Event Detection Policy
CitesDE.AE-2 DE.AE-3 DE.CM-1 +4 +5PDF · WordCites DE.AE-2, Event Analysis (NIST CSF); DE.AE-3, Event Correlation (NIST CSF); DE.CM-1, Network Monitoring (NIST CSF), and 4 more. - NIST CSF7 sections
Continuous Monitoring Policy
CitesDE.CM-1 DE.CM-3 SOC 2 CC4.1 +5 +6PDF · WordCites DE.CM-1, Network Monitoring (NIST CSF); DE.CM-3, Personnel Monitoring (NIST CSF); SOC 2 CC4.1, COSO Principle 16: Monitoring Activities (SOC 2), and 5 more. - NIST CSF8 sections
Incident Response Policy
CitesRS.MA-1 RS.CO-2 SOC 2 CC7.3 +5 +6PDF · WordCites RS.MA-1, Incident Management (NIST CSF); RS.CO-2, Incident Reporting (NIST CSF); SOC 2 CC7.3, System Operations: Incident Response (SOC 2), and 5 more. - NIST CSF7 sections
Recovery Planning Policy
CitesRC.RP-1 RC.CO-1 SOC 2 A1.2 +3 +4PDF · WordCites RC.RP-1, Recovery Plan Execution (NIST CSF); RC.CO-1, Recovery Communication (NIST CSF); SOC 2 A1.2, Availability: Recovery (SOC 2), and 3 more. - NIST CSF7 sections
Communications Policy
CitesRS.CO-2 RC.CO-1 SOC 2 CC2.2 +4 +5PDF · WordCites RS.CO-2, Incident Reporting (NIST CSF); RC.CO-1, Recovery Communication (NIST CSF); SOC 2 CC2.2, COSO Principle 14: Internal Communication (SOC 2), and 4 more.
NIST CSF on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIST CSF + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.