NIST CSF template · NIST CSF 2.0
Risk Assessment Policy
Process for understanding cybersecurity risks to assets, systems, and operations to inform risk response decisions. (NIST CSF 2.0: IDENTIFY, ID.RA) Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 8
- Formats
- PDF, Word
- Shelf
- 10 NIST CSFdocuments in all
No card needed to start.
NIST CSF7 sections
Risk Assessment PolicyProcess for understanding cybersecurity risks to assets, systems, and operations to inform risk response decisions. (NIST CSF 2.0: IDENTIFY, ID.RA)
- Cites
- ID.RA-1, ID.RA-3, ID.RA-5 and 5 more
- Formats
- PDF and Word
NIST CSF shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Risk Assessment Methodology
- Threat and Vulnerability Identification
- Threat Intelligence Integration
- Risk Scoring and Prioritization
- Risk Register
- Review Schedule
Controls it cites
The NIST CSF controls first, then the matching controls in other frameworks.
- ID.RA-1Vulnerability IdentificationNIST CSF
- ID.RA-3Threat IdentificationNIST CSF
- ID.RA-5Risk ResponseNIST CSF
- SOC 2 CC3.1COSO Principle 6: Risk ObjectivesSOC 2
- SOC 2 CC3.2COSO Principle 7: Risk IdentificationSOC 2
- SOC 2 CC3.3COSO Principle 8: Fraud RiskSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- HIPAA §164.308(a)(1)Security Management ProcessHIPAA
- NIST CSF7 sections
Access Control Policy
CitesPR.AA-1 PR.AA-3 PR.AA-5 +5 +6PDF · WordCites PR.AA-1, Identity Management (NIST CSF); PR.AA-3, Remote Access (NIST CSF); PR.AA-5, Access Permissions (NIST CSF), and 5 more. - NIST CSF7 sections
Security Awareness & Training Policy
CitesPR.AT-1 SOC 2 CC1.4 SOC 2 CC2.2 +4 +5PDF · WordCites PR.AT-1, Awareness & Training (NIST CSF); SOC 2 CC1.4, COSO Principle 4: Competence Commitment (SOC 2); SOC 2 CC2.2, COSO Principle 14: Internal Communication (SOC 2), and 4 more. - NIST CSF7 sections
Data Security Policy
CitesPR.DS-1 PR.DS-2 PR.DS-5 +5 +6PDF · WordCites PR.DS-1, Data at Rest (NIST CSF); PR.DS-2, Data in Transit (NIST CSF); PR.DS-5, Data Leak Protection (NIST CSF), and 5 more. - NIST CSF7 sections
Anomaly & Event Detection Policy
CitesDE.AE-2 DE.AE-3 DE.CM-1 +4 +5PDF · WordCites DE.AE-2, Event Analysis (NIST CSF); DE.AE-3, Event Correlation (NIST CSF); DE.CM-1, Network Monitoring (NIST CSF), and 4 more. - NIST CSF7 sections
Continuous Monitoring Policy
CitesDE.CM-1 DE.CM-3 SOC 2 CC4.1 +5 +6PDF · WordCites DE.CM-1, Network Monitoring (NIST CSF); DE.CM-3, Personnel Monitoring (NIST CSF); SOC 2 CC4.1, COSO Principle 16: Monitoring Activities (SOC 2), and 5 more. - NIST CSF8 sections
Incident Response Policy
CitesRS.MA-1 RS.CO-2 SOC 2 CC7.3 +5 +6PDF · WordCites RS.MA-1, Incident Management (NIST CSF); RS.CO-2, Incident Reporting (NIST CSF); SOC 2 CC7.3, System Operations: Incident Response (SOC 2), and 5 more.
NIST CSF on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIST CSF + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.