NIST 800-53 template · NIST SP 800-53 control families
Risk Assessment Policy (RA Family)
Establishes requirements for assessing security risks including vulnerability scanning, threat analysis, and privacy impact assessments, aligned with NIST SP 800-53 RA control family. Written for your company, citing the controls below.
- Sections
- 8
- Controls cited
- 10
- Formats
- PDF, Word
- Shelf
- 10 NIST 800-53documents in all
No card needed to start.
NIST 800-538 sections
Risk Assessment Policy (RA Family)Establishes requirements for assessing security risks including vulnerability scanning, threat analysis, and privacy impact assessments, aligned with NIST SP 800-53 RA control family.
- Cites
- RA-1, SOC 2 CC3.1, SOC 2 CC3.2 and 7 more
- Formats
- PDF and Word
NIST 800-53 shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Risk Assessment Methodology
- Security Categorization
- Vulnerability Scanning
- Threat Intelligence
- Privacy Impact Assessment
- Risk Response
- Assessment Schedule
Controls it cites
The NIST 800-53 controls first, then the matching controls in other frameworks.
- RA-1Risk AssessmentNIST 800-53
- SOC 2 CC3.1COSO Principle 6: Risk ObjectivesSOC 2
- SOC 2 CC3.2COSO Principle 7: Risk IdentificationSOC 2
- SOC 2 CC3.3COSO Principle 8: Fraud RiskSOC 2
- SOC 2 CC9.1Risk Mitigation: Design & ImplementationSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- HIPAA §164.308(a)(1)Security Management ProcessHIPAA
- CSF ID.RA-1Vulnerability IdentificationNIST CSF
- CSF ID.RA-5Risk ResponseNIST CSF
- NIS2 Art. 21.2aRisk Analysis and PoliciesNIS2
- NIST 800-538 sections
Personnel Security Policy (PS Family)
CitesAT-1 SOC 2 CC1.4 SOC 2 CC1.5 +7 +8PDF · WordCites AT-1, Security Awareness Training (NIST 800-53); SOC 2 CC1.4, COSO Principle 4: Competence Commitment (SOC 2); SOC 2 CC1.5, COSO Principle 5: Accountability (SOC 2), and 7 more. - NIST 800-538 sections
Access Control Policy (AC Family)
CitesAC-1 SOC 2 CC6.1 SOC 2 CC6.2 +7 +8PDF · WordCites AC-1, Access Control Policy (NIST 800-53); SOC 2 CC6.1, Logical & Physical Access: Security Software (SOC 2); SOC 2 CC6.2, Logical & Physical Access: Credentials (SOC 2), and 7 more. - NIST 800-538 sections
Audit & Accountability Policy (AU Family)
CitesAU-1 SOC 2 CC7.1 SOC 2 CC7.2 +6 +7PDF · WordCites AU-1, Audit and Accountability (NIST 800-53); SOC 2 CC7.1, System Operations: Detection Mechanisms (SOC 2); SOC 2 CC7.2, System Operations: Monitoring (SOC 2), and 6 more. - NIST 800-537 sections
Security Assessment & Authorization Policy (CA Family)
CitesCA-1 SOC 2 CC4.1 SOC 2 CC4.2 +5 +6PDF · WordCites CA-1, Security Assessment (NIST 800-53); SOC 2 CC4.1, COSO Principle 16: Monitoring Activities (SOC 2); SOC 2 CC4.2, COSO Principle 17: Deficiency Communication (SOC 2), and 5 more. - NIST 800-538 sections
Configuration Management Policy (CM Family)
CitesCM-1 SOC 2 CC8.1 SOC 2 CC3.4 +4 +5PDF · WordCites CM-1, Configuration Management (NIST 800-53); SOC 2 CC8.1, Change Management (SOC 2); SOC 2 CC3.4, COSO Principle 9: Change Impact (SOC 2), and 4 more. - NIST 800-537 sections
Contingency Planning Policy (CP Family)
CitesCP-1 SOC 2 A1.1 SOC 2 A1.2 +6 +7PDF · WordCites CP-1, Contingency Planning (NIST 800-53); SOC 2 A1.1, Availability: Capacity Planning (SOC 2); SOC 2 A1.2, Availability: Recovery (SOC 2), and 6 more.
NIST 800-53 on its own
- Documents
- 10
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so NIST 800-53 + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.