ISO 27001 & 27002 Policy Template UPDATED FOR ISO 27001:2022 & 27002:2022
Product Walkthrough Video
This short product walkthrough video is designed to give a brief overview about what the CDPP is to help answer common questions we receive.
What Is The Cybersecurity & Data Protection Program (CDPP)?
The Cybersecurity & Data Protection Program (CDPP) is our leading set of ISO 27001/2:2013 / 27001/2:2022-based set of cybersecurity policies and standards. This is a comprehensive, customizable, easily implemented document that contains the policies, control objectives, standards and guidelines that your company needs to establish a world-class IT security program. Being Microsoft Word documents, you have the ability to make edits, as needed. The CDPP contains mappings & coverage for both the 2013 and 2022 versions of ISO 27001 and 27002. The ISO 27001 / 27002 version of the CDPP leverages the Secure Controls Framework (SCF) control naming and domains to provide the structure for the policies, control objectives and standards. This approach makes the CDPP scalable and maps to over 100 other laws, regulations and frameworks. Since it is editable documentation, you can use the provided structure or rename it according to your specific needs.
Our products are one-time purchases with no software to install - you are buying Microsoft Office-based documentation templates that you can edit for your specific needs. If you can use Microsoft Office or OpenOffice, you can use this product! The CDPP contains NIST 800-53 based cybersecurity policies & standards in an editable Microsoft Word format:
- Each of the ISO 27001/27002 major sections has a policy associated with it, so there is are policies to cover each functional areas in ISO 27001/2.
- Under each of the policies are standards that support it.
- The CDPP addresses the “why?” and “what?” questions in an audit, since policies and standards form the foundation for your cybersecurity program.
- The CDPP provides the underlying cybersecurity standards that must be in place, as stipulated by statutory, regulatory and contractual requirements.
- Just as Human Resources publishes an “employee handbook” to let employees know what is expected for employees from a HR perspective, the CDPP does this from a cybersecurity perspective.
What Problems Does The CDPP Solve?
- Lack of In House Security Experience - Writing security documentation is a skill that many good cybersecurity professionals simple are not proficient at and avoid the task at all cost. Tasking your security analysts and engineers to write comprehensive documentation means you are actively taking them away from protecting and defending your network, which is not a wise use of their time. The ISO-based CDPP is an efficient method to obtain comprehensive ISO 27002:2022-based security policies and standards for your organization!
- Compliance Requirements - Nearly every organization, regardless of industry, is required to have formally-documented security policies and standards. Requirements range from PCI DSS to HIPAA to EU GDPR. The CDPP is designed with compliance in mind, since it focuses on leading security frameworks to address reasonably-expected security requirements. The CDPP maps to several leading compliance frameworks so you can clearly see what is required!
- Audit Failures - Security documentation does not age gracefully like a fine wine. Outdated documentation leads to gaps that expose organizations to audit failures and system compromises. The CDPP's standards provides mapping to leading security frameworks to show you exactly what is required to both stay secure and compliant.
- Vendor Requirements - It is very common for clients and partners to request evidence of a security program and this includes policies and standards. The CDPP provides this evidence!
How Does the CDPP Solve These Problems?
- Clear Documentation - The CDPP provides comprehensive documentation to prove that your security program exists. This equates to a time saving of hundreds of hours and tens of thousands of dollars in staff and consultant expenses!
- Time Savings - The CDPP can provide your organization with a semi-customized solution that requires minimal resources to fine tune for your organization's specific needs.
- Alignment With Leading Practices - The ISO-based CDPP is written to align your organization with ISO 27001/27002!
When you look at ISO 27001/27002 as it compares to other cybersecurity frameworks, it is right in the middle of the spectrum, based on the topics it covers. You can see example of the ISO 27002 CDPP's policies and standards below, as well as a product walkthrough video.
Product Example - ISO 27001/27002 Cybersecurity Policies & Standards
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the ISO 27001 and 27002 frameworks. It contains cybersecurity policies and standards that align with ISO 27001/27002. You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs. To understand the differences between the NIST 800-53, ISO 27001/27002 and NIST CSF versions of the CDPP, please visit here for more details.
View Product Examples
 |
 |
What Is Included With The CDPP (ISO 27001/27002)?
Cost Savings Estimate - Cybersecurity & Data Protection Program (CDPP)
When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the CDPP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:
- For your internal staff to generate comparable documentation, it would take them an estimated 400 internal staff work hours, which equates to a cost of approximately $90,000 in staff-related expenses. This is about 4-8 months of development time where your staff would be diverted from other work.
- If you hire a consultant to generate this documentation, it would take them an estimated 300 consultant work hours, which equates to a cost of approximately $34,000. This is about 3-6 months of development time for a contractor to provide you with the deliverable.
- The CDPP is approximately 2% of the cost for a consultant or 5% of the cost of your internal staff to generate equivalent documentation.
- We process most orders the same business day so you can potentially start working with the CDPP the same day you place your order.
The process of writing cybersecurity documentation can take an internal team many months and it involves pulling your most senior and experienced cybersecurity experts away from operational duties to assist in the process, which is generally not the most efficient use of their time. In addition to the immense cost of hiring a cybersecurity consultant at $300/hr+ to write this documentation for you, the time to schedule a consultant, provide guidance and get the deliverable product can take months. Even when you bring in a consultant, this also requires involvement from your internal team for quality control and answering questions, so the impact is not limited to just the consultant's time being consumed.
Comprehensive ISO 27001/27002-Based Documentation
The CDPP can serve as a foundational element in your organization's cybersecurity program. It can stand alone or be paired with other specialized products we offer.
Unlike some of our competition that sell “bronze, silver and gold” levels of documentation, we understand that a standard is a standard for a reason. We remove the guesswork associated with picking an appropriate package level - we focus on providing documentation that offers a straightforward solution to provide the appropriate coverage you need. This focus on providing the best solution for our clients makes us proud that we are providing the best set of IT security policies and standards available. Saving a few dollars on a cheap solution can easily leave you with a false sense of security and gaping holes in your documentation that can leave you liable.
Our customers choose the ISO 27001/27002 Cybersecurity & Data Protection Program (CDPP) because they:
- Have a need for comprehensive IT security documentation built on an industry framework
- Need to be able to edit the document to their specific needs
- Have documentation that is directly linked to best practices, laws and regulations
- Need an affordable solution
Creating A Cybersecurity Program Based On ISO 27001/27002 - Information Security Management System (ISMS)
ComplianceForge provides businesses with exactly what they need to protect themselves - professionally written policies, procedures, standards and guidelines at a very affordable cost. Similar documentation standards can be found in Fortune 500 company that have dedicated IT Security staff. All information security policies and standards are backed up by documented best practices. Through the CDPP's use of the Secure Controls Framework (SCF) structure, the CDPP's standards are easily mapped to over 100 laws, regulations and frameworks that the SCF is mapped to.
This Is How ISO 27001/27002 Cybersecurity Documentation Is Meant To Be Structured!
ComplianceForge provides businesses with exactly what they need to protect themselves - professionally written policies, procedures, standards and guidelines at a very affordable cost. Similar documentation standards can be found in Fortune 500 company that have dedicated IT Security staff. All information security policies and standards are backed up by documented best practices.
Hierarchical Approach - Built To Scale & Evolve With Your Business
Our experience has proven that when it comes to Information Security policies, a standard is a standard for a reason. With that in mind, our Cybersecurity & Data Protection Program (CDPP) is based on industry-recognized best practices and Information Security standards so that you can meet your legal requirements. Unlike some competitor sites that offer “Bronze, Silver or Gold” packages that may leave you critically exposed, we offer a comprehensive Information Security solution to meet your specific compliance requirements. Why is this? It is simple - in the real world, compliance is penalty-centric. Courts have established a track record of punishing businesses for failing to perform “reasonably expected” steps to meet compliance with known standards.
The Cybersecurity & Data Protection Program (CDPP) follows a hierarchical approach to how the structure is designed so that standards map to control objectives and control objectives map to policies. This allows for the standards to be logically grouped to support the policies.
The Most Comprehensive ISO 27001/27002-Based Security Documentation Available Online
The ISO 27001/27002-based Cybersecurity & Data Protection Program (CDPP) is a Microsoft Word document that contains Information Security-related policies, standards, procedures and guidelines that are customized to your organization. The CDPP is a comprehensive document that you can edit to your own specific needs, so you have the flexibility to make changes as you need. The CDPP i is a fraction of the cost of doing it yourself or hiring a consultant to write one for you. Lesser Information Security policies and standards are a liability that could prove immensely costly if they do not meet all of your current and future compliance needs.
Our Cybersecurity & Data Protection Program (CDPP) contains thirty-one (31) policies that map directly to ISO 27001 and ISO 27002 requirements:
- Cybersecurity & Privacy Governance
- Asset Management
- Business Continuity & Disaster Recovery
- Capacity & Performance Planning
- Change Management
- Cloud Security
- Compliance
- Configuration Management
- Continuous Monitoring
- Cryptographic Protections
- Data Classification & Handling
- Endpoint Security
- Human Resources Security
- Identification & Authentication
- Incident Response
- Information Assurance
- Maintenance
- Mobile Device Management
- Network Security
- Physical & Environmental Security
- Privacy
- Project & Resource Management
- Risk Management
- Secure Engineering & Architecture
- Security Operations
- Security Awareness & Training
- Technology Development & Acquisition
- Third-Party Management
- Threat Management
- Vulnerability & Patch Management
- Web Security
Each of these policies contain multiple standards and guidelines, so the Cybersecurity & Data Protection Program (CDPP) provides your company with a scalable, best practices-based set of documentation to address your needs now and in the future!
In addition to ISO-based Cybersecurity Policies & Standards, The ISO 27001/27002 CDPP Comes With These Supplemental Cybersecurity Resources
As an extra bonus, we include the following supplemental documentation at no additional cost:
- Excel spreadsheet that maps the standards to multiple statutory, regulatory and contractual frameworks
- User acknowledgement form
- User equipment receipt of issue
- Service provider non-disclosure agreement form
- Incident response form
- Information Security Officer (ISO) appointment orders
- Administrator account request form
- Change Control Board (CCB) meeting documentation template
- Plan of Action & Milestones (POA&M) documentation template
- Ports, protocols & services documentation template
- Statutory, Regulatory & Legal compliance checklist
- Incident Response Plan (IRP) template
- Business Impact Analysis (BIA) template
- Disaster Recovery Plan (DRP) template
- Business Continuity Plan (BCP) template
- Privacy Impact Assessment (PIA) template
- Electronic discovery (e-discovery) guidelines
This documentation saves hundreds of hours by not having to make it on your own!
Why Does Your Business Need A Cybersecurity & Data Protection Program (CDPP)?
It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft. If you have two or more employees, a CDPP is just as important as the professional liability insurance you carry on your business. The ISO 27002 Cybersecurity & Data Protection Program (CDPP) provides a comprehensive framework to manage your company’s Information Security program. The ISO 27001/27002 Cybersecurity & Data Protection Program (CDPP) allows you to implement and document the steps to be compliant with Federal, state and industry laws and regulations.
It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft. If you have two or more employees, a CDPP is just as important as the professional liability insurance you carry on your business.
We were the industry's first source for a customized, on-demand Cybersecurity & Data Protection Program (CDPP) that is specifically tailored for small and medium sized business. Our Cybersecurity & Data Protection Program (CDPP) follows industry-recognized best practices (e.g. ISO 27001 and ISO 27002) and we reference applicable laws, requirements, standards, and best practices that businesses need to follow to be considered compliant with common information security requirements. Unfortunately, ignorance is neither bliss, nor is it an excuse! What your employees do not know has the proven ability to hurt your company. In terms of liability for a company, security does not exist until it is documented.
The benefits of Information Security for businesses of any size are many:
- Decreased costs - less reactive IT support
- Improved productivity - decreased distractions
- Less virus & spyware outbreaks - decreased downtime & expense
- More efficient operations - better performing network & computers
- Better accountability of assets & resources
- Better educated & trained employees
- Having documentation to prove you are doing the right thing
How Is A Cybersecurity & Data Protection Program (CDPP) Applicable To You?
Our ISO 27002-based Cybersecurity & Data Protection Program (CDPP) is something applicable to every business, regardless of the number of employees. The harsh reality is that small and medium-sized businesses have always been at a disadvantage when it comes to securing their networks from threats. Generally, the lack of IT expertise and staffing are the contributing factors, but the overwhelming issue is a false sense of security.
Most smaller businesses lack a dedicated IT staff and must rely on outsourced expertise. This is a good solution for most technology needs, but the vast majority of IT companies that support smaller businesses lack the expertise to properly consult their clients on Information Security and what compliance issues they should be concerned with. This is where ComplianceForge is a wonderful resource, since our focus on Information Security products and services can be implemented by your current IT provider. We provide them with the roadmap and the tools to properly secure your network and make you compliant. It is as easy as that!
Lesser products are a liability that could prove immensely costly if they do not meet all of your current and future compliance needs. Since ignorance is neither bliss, nor is it an excuse, you need to be able to prove you followed due care & due diligence to protect your business. In terms of liability for a company, security does not exist until it is documented! We developed our products based on NIST 800-53 and ISO 27002 best practices, which follow the ISO 27001/27002 framework for an Information Security Management System (ISMS). This false sense of security comes from business owners not asking the question of what issues they should be compliant with and from the IT provider or staff not being proactive and bringing up compliance issues to management. This scenario creates a dangerous set of assumptions that can potentially put the company out of business.
Which Product Is Right For You?
Our documentation is meant to address your requirements from strategic concepts all the way down to day-to-day deliverables you need to demonstrate compliance with common statutory, regulatory and contractual obligations. We offer up to 45% discounts on our documentation bundles, so please be aware that you have benefit from significant savings by bundling the documentation you need. You can see the available bundles here.
We are here to help make comprehensive cybersecurity documentation as easy and as affordable as possible. We serve businesses of all sizes, from the Fortune 500 all the way down to small businesses, since our cybersecurity documentation products are designed to scale for organizations of any size or level of complexity. Our affordable solutions range from cybersecurity policies & standards documentation, to NIST 800-171 compliance checklists, to program-level documentation, such as "turn key" incident response, risk management or vulnerability management program documents. Our focus is on helping you become audit ready!
As you see in the graphic below, the CDPP serves as a foundational component of your cybersecurity & data protection program. The CDPP addresses the "What" & "Why" requirements to be secure. Other ComplianceForge documentation can help speed up the effort to operationalize any requirements you have. Those additional documents help address the "How" of running a cybersecurity & data protection program.
Optional Professional Services (Add On)
ComplianceForge offers optional professional services to customize purchased documentation. Professional services are not required to customize ComplianceForge documentation. However, some clients want our subject matter expertise to help customize their documentation to meet their specific business needs. If you have any questions about our professional services, please contact us at: www.complianceforge.com/contact-us/.
We offer our professional services in bundles of: five (5), ten (10) & twenty (20) hours.
Purchased professional service hours will expire after 120 days (4 months) from the time of purchase before they expire.