No reviews yet
$43,240.00
$23,782.00
(You save $19,458.00 )

CMMC Bundle 4: Levels 1-3 (DSP & SCF)

SKU:
CMMC-B4-L3-NO
UPC:
692878857147
Availability:
Email Delivery Within 1-2 Business Days

Maximum file size is 15000KB, file types are bmp, gif, jpg, jpeg, jpe, jif, jfif, jfi, png, wbmp, xbm, tiff

Adding to cart… The item has been added

nist 800-171 cmmc compliance documentation template example

NIST 800-171 & CMMC 2.0 Compliance Bundle #4 - EXPERT  CMMC 2.0 Levels 1-3  (45% discount)

This is a bundle that includes the following thirteen (13) ComplianceForge products that are focused on operationalizing NIST SP 800-171 and Cybersecurity Maturity Model Certification (CMMC): 

  1. Digital Security Program (DSP)
  2. Cybersecurity Standardized Operating Procedures (CSOP)
  3. Risk Management Program (RMP)
  4. Cybersecurity Risk Assessment Template (CRA)
  5. Vulnerability & Patch Management Program (VPMP)
  6. Integrated Incident Response Program (IIRP) 
  7. Continuity of Operations Plan (COOP)
  8. Secure Baseline Configurations (SBC)
  9. Information Assurance Program (IAP)
  10. Secure Engineering & Data Privacy (SEDP)
  11. Cybersecurity Business Plan (CBP)
  12. System Security Program (SSP) & Plan of Actions & Milestones (POA&M)
  13. NIST 800-161 R1-based Cybersecurity Supply Chain Risk Management Strategy and Implementation Plan (CSCRM-SIP)

Digital Security Program (DSP) / Secure Controls Framework (SCF)-based cybersecurity documentation bundle. This bundle is designed for organizations that need to comply with NIST 800-171 and CMMC Level 1-3. This is beyond just the cybersecurity policies and standards and addresses the unique compliance needs for NIST 800-171. The end result is a comprehensive, customizable, easily implemented set of documentation that your company needs to establish an NIST 800-53-based cybersecurity program. Being Microsoft Word documents, you have the ability to make edits, as needed. 

SCF Connect Free Trial | SCF GRC

2021.1-cmmc-bundle-4.jpg

“DIBCAC Battle Tested” NIST 800-171, NIST 800-171A & CMMC 2.0 Policies, Standards & Procedures

ComplianceForge’s NIST 800-171 / CMMC documentation has been used successfully by multiple companies during DIBCAC assessments to efficiently and effectively generate the necessary artifact documentation to demonstrate compliance with NIST SP 800-171 controls and NIST SP 800-171A control objectives. This battle tested documentation includes the necessary policies, standards, procedures, SSP, POA&M, Incident Response Plan (IRP) and other documentation that are expected to exist to successfully pass a third-party assessment, be it DIBCAC or a C3PAO.

Focused on NIST 800-171 & CMMC 2.0 Level 1-3 Compliance - EXPERT DOCUMENTATION COVERAGE

In the downloadable CMMC requirements mapping matrix shown below, you can see how all CMMC 2.0 Level 1, 2 & 3 (old CMMC v1.02 Levels 1-5) requirements are supported by the Digital Security Program (DSP).

 2020-02-03-cmmc-v1.0-requirements-matrix-download.jpg

 

2020-cybersecurity-goldilocks-spectrum-comparison-secure-controls-framework-metaframework.jpg

Cost Savings Estimate - NIST 800-171 & CMMC 2.0 Bundle #4

When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing this bundle from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:

  • For your internal staff to generate comparable documentation, it would take them an estimated 3,900 internal staff work hours, which equates to a cost of approximately $334,000 in staff-related expenses. This is about 30-48 months of development time where your staff would be diverted from other work.
  • If you hire a consultant to generate this documentation, it would take them an estimated 2,900 contractor work hours, which equates to a cost of approximately $874,000. This is about 20-30 months of development time for a contractor to provide you with the deliverable.
  • This bundle is approximately 5% of the cost for a consultant or 13% of the cost of your internal staff to generate equivalent documentation.
  • We process most orders the same business day so you can potentially start working with the documentation the same day you place your order.

NIST 800-171 compliance bundle

Product Hierarchy & Interactions

The diagram below helps visualize how the DSP exists at a strategic level to define the "what" and "why" requirements to be secure and compliant. Those foundational policies and standards influence every other component of your cybersecurity and data protection program.

ComplianceForge editable cybersecurity policies standards procedures

Products Included in NIST 800-171 & CMMC Bundle #4 (DSP version)

The DSP is targeted for larger, enterprise environments, but more differences between the CDPP and DSP can be read about here.

Digital Security Program

Digital Security Program (DSP)
The DSP addresses more than just the “why?” and “what?” questions in an audit, since in addition to the core policies and standards that form the foundation for your cybersecurity program, the DSP comes with controls and metrics! 

  • Most popular product for organizations that need to address multiple compliance obligations and cannot be locked into a single framework (e.g., NIST 800-53, ISO 27002 or NIST Cybersecurity Framework).
  • Maps to over 100 statutory, regulatory and contractual cybersecurity and privacy frameworks to create a hybrid approach to cybersecurity policies, standards, controls and metrics.
  • Provides 1-1 mapping with the Secure Controls Framework (SCF), so you can easily align your policies, standards and metrics with the controls you use from the SCF!
  • DSP contains many useful supplemental documentation templates:
    • Data classification & handling guidelines
    • Data retention guidelines
    • Rules of behavior (acceptable use)
    • and many more templates
NIST 800-161 cybersecurity supply chain risk management NIST SP 800-161 Rev 1-Based Cybersecurity Supply Chain Risk Management Strategy & Implementation Plan (C-SCRM SIP)  
The C-SCRM SIP is focused on helping companies manage their supply chain securely by establishing a C-SCRM Program that can operational a C-SCRM strategy through a viable implementation plan. This is important from an Executive Order (EO), Supply Chain Risk Management (SCRM), NIST SP 800-171 and CMMC perspective, due to the "flow down" of compliance requirements to service providers, contractors, suppliers, etc. The C-SCRM SIP is a way to help manage technology-related supply chain risk and inform organizations within the supply chain what their requirements are.

NIST 800-171 system security plan System Security Plan (SSP) & Plan of Action & Milestones (POA&M) Templates 
These are fully editable templates to address a compliance need for NIST 800-171 and CMMC.
  • One template is a Microsoft Word-based System Security Plan (SSP) that contains all the criteria necessary to have your SSP documented to meet NIST 800-171 compliance expectations.
  • One template is a Microsoft Excel-based Plan of Action & Milestones (POA&M) that contains fields necessary to track control deficiencies from identification through remediation.
cybersecurity procedures template Cybersecurity Standardized Operating Procedures Template (CSOP) - DSP Version
The DSP version of the CSOP is a template for procedures. This is an expectation that companies have to demonstrate HOW cybersecurity controls are actually implemented.
  • This is an editable Microsoft Word document.
  • Given the difficult nature of writing templated procedure statements, we aimed for approximately a "80% solution" since it is impossible write a 100% complete cookie cutter procedure statement that can be equally applied across multiple organizations. What this means is ComplianceForge did the heavy lifting and you just need to fine-tune the procedure with the specifics that only you would know to make it applicable to your organization. It is pretty much filling in the blanks and following the helpful guidance that we provide to identify the who/what/when/where/why/how to make it complete.
  • The CSOP is mapped to leading frameworks to help with mapping compliance requirements.
integrated incident response plan Integrated Incident Response Program (IIRP)
The IIRP addresses the “how?” questions for how your company manages cybersecurity incidents.
  • This is primarily an editable Microsoft Word document, but it comes with Microsoft Excel and Microsoft Visio templates.
  • In summary, this addresses fundamental needs when it comes to incident response requirements:
    • Defines the hierarchical approach to handling incidents.
    • Categorizes eleven different types of incidents and four different classifications of incident severity.
    • Defines the phases of incident response operations, including deliverables expected for each phase.
    • Defines the Integrated Security Incident Response Team (ISIRT) to enable a unified approach to incident response operations.
    • Defines the scientific method approach to incident response operations.
    • Provides guidance on how to write up incident reports (e.g., lessons learned).
    • Provides guidance on forensics evidence acquisition.
    • Identifies and defines Indicators of Compromise (IoC).
    • Identifies and defines sources of evidence.  
    • The IIRP contains “tabletop exercise” scenarios, based on the categories of incidents.
    • This helps provide evidence of due care in how your company handles cybersecurity incidents.
    • The IIRP is based on industry-leading practices for incident response.
risk management program Risk Management Program (RMP)
The RMP addresses the “how?” questions for how your company manages risk.
  • This is an editable Microsoft Word document that provides program-level guidance to directly supports the CDPP and DSP policies and standards for managing cybersecurity risk.
  • In summary, this addresses fundamental needs when it comes to risk management requirements:
    • How risk is defined.
    • Who can accept risk.
    • How risk is calculated by defining potential impact and likelihood.
    • Necessary steps to reduce risk.
    • Risk considerations for vulnerability management.
    • The RMP is based on leading frameworks, such as NIST 800-37, NIST 800-39, ISO 31010 and COSO 2013.
cybersecurity risk assessment template Cybersecurity Risk Assessment (CRA) Template
The CRA supports the RMP product in answering the “how?” questions for how your company manages risk.
  • This contains both an editable Microsoft Word document and Microsoft Excel spreadsheet that allows for professional-quality risk assessments.
  • The CRA directly supports the Risk Management Program (RMP), as well as the CDPP/DSP's policies and standards, for managing cybersecurity risk. It does this by enabling your company to produce risk assessment reports.
vulnerability & patch management program Vulnerability & Patch Management Program (VPMP)
The VPMP addresses the “how?” questions for how your company manages technical vulnerabilities and patch management operations.
  • This is an editable Microsoft Word document that provides program-level guidance to directly supports the CDPP and DSP policies and standards for managing vulnerabilities.
  • In summary, this addresses fundamental needs when it comes to vulnerability management requirements:
    • Who is responsible for managing vulnerabilities.
    • What is in scope for patching and vulnerability management.
    • Defines the vulnerability management methodology.
    • Defines timelines for conducting patch management operations.
    • Considerations for assessing risk with vulnerability management.
    • Vulnerability scanning and penetration testing guidance.
secure engineering & data privacy program Secure Engineering & Data Privacy (SEDP)
The SPBD addresses the “how?” questions for how your company ensures both security and privacy principles are operationalized.
  • This is an editable Microsoft Word document that provides program-level guidance to directly supports the CDPP and DSP policies and standards for ensuring secure engineering and privacy principles are operationalized on a daily basis.
  • The concept of “secure engineering” is mandatory in numerous statutory, regulatory and contractual requirements. The SPBD provides a “paint by numbers” approach to ensure your company has evidence of both due care and due diligence for operationalizing security and privacy principles.
  • The SPBD is based on numerous industry frameworks, but the core is NIST 800-160, which is the de facto standard on secure engineering.
continuity of operations program Continuity of Operations Program (COOP)
The COOP addresses the “how?” questions for how your company plans to respond to disasters to maintain business continuity.
  • This is an editable Microsoft Word document that provides program-level guidance to directly supports the CDPP's policies and standards for disaster recovery and business continuity operations.
  • The concept of “continuity operations” spans incident response to disaster recovery to business continuity operations. This is a very common requirement in numerous statutory, regulatory and contractual requirements. The COOP provides your organization with the documentation to prove it addresses both disaster recovery and business continuity.
  • The COOP is based on numerous frameworks to provide a holistic approach to DR and BC operations. 
secure baselines configurations Secure Baseline Configurations (SBC)
The SBC addresses the “how?” questions for how your company securely configures its technology assets, such as system hardening according to CIS Benchmarks, DISA STIGs or vendor recommendations.
  • This is an editable Microsoft Word document that provides program-level guidance to direct systems administrators, third-parties and other asset custodians on the expectation to harden operating systems, applications and services.
  • The hardening of systems is a basic requirement, but most organization struggle with a way to document the requirements they are using to secure their assets. This is where the SBC comes into play.
  • The SBC leverages multiple sources for "industry best practices" and you are able to select what works best for your organization. 
information assurance program Information Assurance Program (IAP)
The IAP addresses the “how?” questions for how your company performs pre-production testing to ensure that both cybersecurity and privacy principles are built-in by default.
  • This is an editable Microsoft Word document that provides program-level guidance to conduct pre-production testing that ties in with existing SDLC/PDLC processes.
  • The IAP leverages multiple sources for "industry best practices" and is based on practices used by the US Government for Information Assurance (IA) and Security Testing & Evaluation (ST&E).
cybersecurity business plan Cybersecurity Business Plan (CBP)
The CBP is a cybersecurity-focused business planning template to document your organization's cybersecurity strategy and roadmap.
  • This is an editable Microsoft Word document that provides an easy-to-follow template to build out a cybersecurity strategy and a roadmap to improve the cybersecurity practices of your organization. 
  • The CBP is focused on helping organizations create, maintain and leverage a security strategy and roadmap for organizational cybersecurity improvement.  

 

What ComplianceForge Products Apply To NIST 800-171 Compliance & CMMC?

Based on the requirements from DFARS, we made this bundle to simplify the efforts to comply. When you break down the requirements to comply with DFARS / NIST 800-171, you will see how the products address a specific compliance need:

ComplianceForge Product DFARS Requirement
Digital Security Program (DSP) [Secure Controls Framework] 252.204-7008
252.204-7012
NIST 800-171 (multiple NFO controls)
Third Party Security Management (TPSM) 252.204-7008
252.204-7012
NIST 800-171 NFO PS-7
Cybersecurity Risk Management Program (RMP) 252.204-7008
252.204-7012
NIST 800-171 NFO RA-1
Cybersecurity Risk Assessment Template (CRA) 252.204-7008
252.204-7012
NIST 800-171 3.11.1
Vulnerability & Patch Management Program (VPMP) 252.204-7008
252.204-7012
NIST 800-171 3.11.2
Integrated Incident Response Program (IIRP) 252.204-7008
252.204-7009
252.204-7010
252.204-7012
NIST 800-171 3.6.1
Security & Privacy By Design (SPBD) 252.204-7008
252.204-7012
NIST 800-171 NFO SA-3
System Security Plan (SSP) 252.204-7008
252.204-7012
NIST 800-171 3.12.4
Cybersecurity Standardized Operating Procedures (CSOP) 252.204-7008
252.204-7012
NIST 800-171 (multiple NFO controls)
Continuity of Operations Plan (COOP) 252.204-7008
252.204-7012
NIST 800-171 3.6.1
Secure Baseline Configurations (SBC) 252.204-7008
252.204-7012
NIST 800-171 3.4.1
Information Assurance Program (IAP) 252.204-7008
252.204-7012
NIST 800-171 NFO CA-1

 

Optional Professional Services (Add On)

ComplianceForge offers optional professional services to customize purchased documentation. Professional services are not required to customize ComplianceForge documentation. However, some clients want our subject matter expertise to help customize their documentation to meet their specific business needs. If you have any questions about our professional services, please contact us at: www.complianceforge.com/contact-us/.

We offer our professional services in bundles of: five (5), ten (10) & twenty (20) hours.

Purchased professional service hours will expire after 120 days (4 months) from the time of purchase before they expire.

 

Please note that if you want a customized bundle, we are happy to create one for you. Just contact us with your needs and we will generate a quote for you.

Videos Hide Videos Show Videos

Reviews


Learn More About Cybersecurity & Data Privacy