NIST CSF template · NIST CSF 2.0
Continuous Monitoring Policy
Systems and assets are monitored to identify cybersecurity events and verify protective measure effectiveness. (NIST CSF 2.0: DETECT, DE.CM) Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 8
- Formats
- PDF, Word
- Shelf
- 10 NIST CSFdocuments in all
No card needed to start.
NIST CSF7 sections
Continuous Monitoring PolicySystems and assets are monitored to identify cybersecurity events and verify protective measure effectiveness. (NIST CSF 2.0: DETECT, DE.CM)
- Cites
- DE.CM-1, DE.CM-3, SOC 2 CC4.1 and 5 more
- Formats
- PDF and Word
NIST CSF shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Monitoring Program Components
- Monitoring Tools and Technology
- Vulnerability Scanning Schedule
- Endpoint Detection and Response
- User and Entity Behavior Analytics
- Monitoring Program Review
Controls it cites
The NIST CSF controls first, then the matching controls in other frameworks.
- DE.CM-1Network MonitoringNIST CSF
- DE.CM-3Personnel MonitoringNIST CSF
- SOC 2 CC4.1COSO Principle 16: Monitoring ActivitiesSOC 2
- SOC 2 CC7.1System Operations: Detection MechanismsSOC 2
- SOC 2 CC7.2System Operations: MonitoringSOC 2
- ISO A.8.15LoggingISO 27001
- PCI DSS Req. 10Log & MonitorPCI DSS
- PCI DSS Req. 11Test SecurityPCI DSS
- NIST CSF8 sections
Incident Response Policy
CitesRS.MA-1 RS.CO-2 SOC 2 CC7.3 +5 +6PDF · WordCites RS.MA-1, Incident Management (NIST CSF); RS.CO-2, Incident Reporting (NIST CSF); SOC 2 CC7.3, System Operations: Incident Response (SOC 2), and 5 more. - NIST CSF7 sections
Recovery Planning Policy
CitesRC.RP-1 RC.CO-1 SOC 2 A1.2 +3 +4PDF · WordCites RC.RP-1, Recovery Plan Execution (NIST CSF); RC.CO-1, Recovery Communication (NIST CSF); SOC 2 A1.2, Availability: Recovery (SOC 2), and 3 more. - NIST CSF7 sections
Communications Policy
CitesRS.CO-2 RC.CO-1 SOC 2 CC2.2 +4 +5PDF · WordCites RS.CO-2, Incident Reporting (NIST CSF); RC.CO-1, Recovery Communication (NIST CSF); SOC 2 CC2.2, COSO Principle 14: Internal Communication (SOC 2), and 4 more. - NIST CSF7 sections
Asset Management Policy
CitesID.AM-1 ID.AM-2 ID.AM-5 +4 +5PDF · WordCites ID.AM-1, Hardware Inventory (NIST CSF); ID.AM-2, Software Inventory (NIST CSF); ID.AM-5, Resource Prioritization (NIST CSF), and 4 more. - NIST CSF7 sections
Risk Assessment Policy
CitesID.RA-1 ID.RA-3 ID.RA-5 +5 +6PDF · WordCites ID.RA-1, Vulnerability Identification (NIST CSF); ID.RA-3, Threat Identification (NIST CSF); ID.RA-5, Risk Response (NIST CSF), and 5 more. - NIST CSF7 sections
Access Control Policy
CitesPR.AA-1 PR.AA-3 PR.AA-5 +5 +6PDF · WordCites PR.AA-1, Identity Management (NIST CSF); PR.AA-3, Remote Access (NIST CSF); PR.AA-5, Access Permissions (NIST CSF), and 5 more.
NIST CSF on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIST CSF + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.