Key Takeaways - Cybersecurity Documentation Products
- ComplianceForge sells individual cybersecurity documentation products across 9 categories.
- All products are editable (Word, Excel, PowerPoint), customized with your logo, and delivered same-day.
- Each product page includes PDF examples and cost savings estimates.
- Looking for bundled savings? Visit the Bundles page for 20-45% discounts.
Effective Cybersecurity Documentation
Concise & Clear Cybersecurity & Data Privacy Documentation
Effective cybersecurity and data protection is a team effort involving the participation and support of every user that interacts with your company’s data and/or systems, it is a necessity for your company’s cybersecurity & data protection requirements to be made available to all users in a format that they can understand. That means your company must publish those requirements in some manner, generally in either PDF format or published to an internal document management tool (e.g., GRC/IRM, SharePoint, wiki, etc.). Regardless of the format in which you deliver your documentation to end users, our goal is to make that process as efficient, cost-effective and scalable, as possible.
ComplianceForge's Experience
We Know How To Write Cybersecurity & Data Privacy Documentation - Scalable, Comprehensive & Efficient
We leverage the Hierarchical Cybersecurity Governance Framework to take a comprehensive view towards the necessary documentation components that are key to being able to demonstrate evidence of due diligence and due care. This framework addresses the interconnectivity of policies, control objectives, standards, guidelines, controls, risks, procedures & metrics. This approach works well with any cybersecurity framework to help any organization, regardless of industry, to get and stay both secure and compliant.
ComplianceForge has simplified the concept of the hierarchical nature of cybersecurity and privacy documentation in the following downloadable diagram that demonstrates the unique nature of each documentation component that is expected to exist as part of a cybersecurity and privacy program. You can click on the image below to better understand how we write our documentation to link from policies all the way down to metrics.
Establishing Context
Establishing Context For Cybersecurity & Privacy Documentation
Your cybersecurity & data protection documentation is meant to address the “who, what, when, how & why” across the strategic, operational and tactical needs of your organization:
In a business context, cybersecurity and privacy documentation (e.g., policies, standards, procedures, etc.) provide direction to all employees and contractors within an organization to address needs for secure practices. This guidance for cybersecurity and data protection is intended to be in accordance with the organization's overall business objectives (e.g., strategic business plan), as well as relevant laws, regulations and other legal obligations for cybersecurity and privacy.
The development and implementation of the policies and standards is evidence of due diligence that the organization's compliance obligations are designed to address applicable administrative, technical and physical security controls. It is important to ensure that policies and standards document what the organization is doing, as the policies and standards are often the mechanisms by which outside regulators measure implementation and maturity of the control.
- Creating a clearly articulated approach to how your company handles cybersecurity – in terms of ISO 27001, this concept would be considered an Information Security Management System (ISMS).
- Protecting the confidentiality, integrity, availability and safety of data and systems on your network.
- Providing guidance to help ensure the effectiveness of cybersecurity and data protection controls that are put in place to support your company’s operations.
- Helping your users to recognize the highly-networked nature of the current computing environment to provide effective company-wide management and oversight of those related cybersecurity risks.
The objective is to provide management direction and implement necessary cybersecurity and data protections in accordance with business requirements and relevant laws and regulations.
Editable, Scalable & Affordable
Cybersecurity & Data Privacy Documentation
While policies and standards are designed to describe WHY something is required and WHAT needs to be done, many companies fail to create documentation to address HOW the policies and standards are actually implemented
When you "peel back the onion" and want to build an audit-ready cybersecurity and privacy program, there is a need to address "the how" for certain topics, such as vulnerability management, risk management, vendor management and incident response. We did the heavy lifting and created several program-level documents to address this need!
Based On Best Practices
Written Information Security Documentation Starts with Policies & Standards Based on Industry-Recognized Best Practices
A single negligent breach can close your business forever, because your liability insurance may not cover professional negligence if you are unable to provide evidence that you took reasonable steps to prevent a breach or other cybersecurity-related incident. Without the ability to prove steps were taken to ensure due care and due diligence were applied to your business operations, you may be considered negligent in a lawsuit and be fully exposed to fines, penalties and damages.
This is where ComplianceForge can help, since we have the information security solutions that your company needs to be able to prove evidence of due care and due diligence with industry-accepted best practices for IT security. From IT security policies, to risk assessments, to vendor management solutions, we can help you keep your company secure! Documentation serves as the foundational building blocks for your cybersecurity and privacy program. Without properly-scoped policies to address your applicable statutory, regulatory and contractual obligations, your associated standards and procedures will likely be inadequate to meet your compliance needs. The requires a holistic approach to right-sizing your cybersecurity program to meet your organization's specific compliance and security requirements.
Program-Level Guidance
Concept of Operations (CONOPS) Provides Program-Level Guidance
A Concept of Operations (CONOPS) is a user-oriented guidance document that describes the mission, operational objectives and overall expectations from an integrated systems point of view, without being overly technical or formal. A CONOPS is meant to:
- Benefit stakeholders by establishing a baseline “operational concept” to establish a conceptual, clearly-understood view for everyone involved in the scope of operations described by the CONOPS.
- Record design constraints, the rationale for those constraints and to indicate the range of acceptable solution strategies to accomplish the mission and any stated objectives.
- Contain a conceptual view that illustrates the top-level functionality in the proposed process or system.
Several ComplianceForge documents are essentially CONOPS documents, where CONOPS are more conceptual than procedures and are focused on providing program-level guidance. A CONOPS straddles the territory between an organization's centrally-managed policies/standards and its decentralized, stakeholder-executed procedures, where CONOPS serves as expert-level guidance that is meant to run a specific function. Examples of where a CONOPS is useful for providing program-level guidance:
Your organization’s Subject Matter Experts (SMEs) are expected to use a CONOPS as a tool to communicate user needs and system characteristics to developers, integrators, sponsors, funding decision makers and other stakeholders.
Editable Policies & Standards Templates
Policies & Standards
The foundation of any cybersecurity program. Policies define management intent while standards specify the requirements your organization must follow. Choose the framework alignment that matches your compliance obligations.
$ 10,400.00 USD
This version of the SCRP is a hybrid, "best in class" approach to cybersecurity documentation that covers dozens of statutory, regulatory and contractual frameworks to create a comprehensive set of cybersecurity policies & standards. The SCRP has a 1-1 mapping relationship with the Secure Controls Framework (SCF) so it maps to over 200 leading practices!
$ 1,980.00 USD
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the NIST Cybersecurity Framework 2.0 (NIST CSF 2.0) framework. It contains the necessary NIST CSF policies and standards that help achieve compliance with NIST CSF. You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
$ 1,980.00 USD
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the ISO 27001 / 27002 framework. It contains the necessary ISO 27001 / 27002 policies and standards that help achieve compliance. You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
$ 1,980.00 USD
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the NIST 800-53 rev5 framework. It contains cybersecurity policies and standards that align with NIST 800-53 (including NIST 800-171 & CMMC requirements). You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
$ 2,970.00 USD
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the NIST SP 800-53 rev5 framework. It contains cybersecurity policies and standards that align with NIST SP 800-53 (including NIST SP 800-171 requirements). You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
$ 600.00 USD
This version of the Cybersecurity & Data Protection Program (CDPP) is based on the SCF CORE Fundamentals from the Secure Controls Framework (SCF). It contains the necessary policies and standards that help achieve compliance with the SCF. You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
Editable Procedures Templates
Cybersecurity Procedures
Procedures operationalize your policies into actionable, step-by-step instructions your teams use daily. Available in the same framework alignments as the policies above.
$ 6,400.00 USD
This version of the SCRP is a hybrid, "best in class" approach to cybersecurity documentation that covers dozens of statutory, regulatory and contractual frameworks to create a comprehensive set of cybersecurity procedures. The SCRP has a 1-1 mapping relationship with the Secure Controls Framework (SCF) so it maps to over 200 leading practices!
$ 4,700.00 USD
This version of the Cybersecurity Standardized Operating Procedures (CSOP) is based on the NIST Cybersecurity Framework 2.0 (NIST CSF 2.0) framework. It contains the necessary NIST CSF procedures that help achieve compliance with NIST CSF. You get fully-editable Microsoft Word documents that you can customize for your specific needs.
$ 4,700.00 USD
This version of the Cybersecurity Standardized Operating Procedures (CSOP) is based on the ISO 27001 / 27002 framework. It contains the necessary ISO 27001 / 27002 procedures that help achieve compliance with ISO 27001 / 27002. You get fully-editable Microsoft Word documents that you can customize for your specific needs.
$ 4,700.00 USD
This version of the Cybersecurity Standardized Operating Procedures (CSOP) is based on the NIST 800-53 Rev 5 framework. It contains cybersecurity procedures that align with NIST 800-53 (including NIST 800-171 & CMMC requirements). You get fully-editable Microsoft Word documents that you can customize for your specific needs.
$ 5,995.00 USD
This version of the Cybersecurity Standardized Operating Procedures (CSOP) is based on the NIST 800-53 Rev 5 framework. It contains cybersecurity procedures that align with NIST 800-53 (including NIST 800-171 & CMMC requirements). You get fully-editable Microsoft Word documents that you can customize for your specific needs.
$ 1,400.00 USD
This version of the Cybersecurity Standardized Operating Procedures (CSOP) is based on the SCF CORE Fundamentals from the Secure Controls Framework (SCF). It contains the necessary procedures that help achieve compliance with the SCF. You get fully-editable Microsoft Word and Excel documents that you can customize for your specific needs.
Cybersecurity Supply Chain Risk Management
Supply Chain Risk Management
Managing cybersecurity risk across your supply chain is increasingly required by regulation and contract. These products address NIST SP 800-161 Rev 1 and federal supply chain mandates.
$ 1,100.00 USD
The SCRM Plan template is an editable Microsoft Word document that is intended to operationalize a C-SCRM Plan that can enforce security across your supply chain (e.g., service providers, vendors, contractors, etc.). This product includes a wealth of information to customize a SCRM/C-SCRM Plan that is specific to your organization.
$ 4,235.00 USD
The C-SCRM SIP is an editable Microsoft Word document that is intended to operationalize a C-SCRM Program that can enforce security across your supply chain (e.g., service providers, vendors, contractors, etc.). This is fully-editable documentation (e.g., Word, Excel, PowerPoint, etc.) that can enable your organization to "hit the ground running" with C-SCRM operations that are aligned with NIST SP 800-161 Rev 1.
NIST 800-171 Compliance
NIST 800-171 & CMMC
Defense contractors handling CUI must demonstrate NIST 800-171 compliance. These products provide the documentation foundation for CMMC Level 2 assessments and federal supply chain requirements.
$ 5,200.00 USD
The NCP is designed to fit the needs of small to medium businesses in need of a “square peg for a square hole” to singularly address NIST 800-171 and CMMC compliance requirements. The NCP is "battle tested" - our clients have successfully passed DIBCAC assessments with this documentation, including a CMMC Third-Party Assessment Organization (C3PAO).
$ 950.00 USD
The SSP is meant to be a "living document" that captures pertinent information on the controls implementation for NIST 800-171. Specifically, the SSP template covers all Controlled Unclassified Information (CUI) and Non-Federal Organization (NFO) controls that are listed in Appendices D and E of NIST 800-171. The SSP can serve as a key element in your organization's cybersecurity program.
Risk Management
Cybersecurity Risk Management
Formal risk management enables informed decision-making. These products cover risk assessments, treatment plans, third-party vetting, physical security, and strategic business planning.
$ 900.00 USD
The Physical Security Plan (PSP) was created with the intent to minimize risk to an organization’s systems and data by addressing applicable physical security and environmental concerns and establishing processes that will help ensure physical security and environmental risks are minimized or avoided.
$ 2,175.00 USD
The RMP is designed to address the strategic, operational and tactical components of risk management to provide cybersecurity risk management governance and provides this middle ground between high-level policies and the actual procedures of how risk is managed on a day-to-day basis by those individual contributors who execute risk-based controls.
$ 1,200.00 USD
The TPRM Program includes TPRM policy, a phased approach to managing Third-Party Service Providers (TPSP) across the entire vendor lifecycle, and a TPRM questionnaire that you can use to assess TPSP. In other words, ComplianceForge’s TPRM Program offers the entire pie for TPRM, unlike other companies who offer only a single piece of the pie.
$ 950.00 USD
The CRA provides you a format to produce high-quality risk assessment reports, based on the Risk Management Program's (RMP) structure of managing risk. The CRA provides a high-quality template to actually perform the risk assessments that are called for by policies, standards and procedures. This allows your organization to have a risk assessment template that is repeatable and looks professional.
Data Protection (Privacy) & Secure Engineering
Data Privacy & Secure Engineering
Global privacy regulations require documented programs for data protection, consent management, and privacy-by-design. Address GDPR, CCPA/CPRA, and other regulations.
$ 3,300.00 USD
The Data Privacy Program (DPP) is an editable "privacy program template" that exists to ensure data protection-related controls are adequately identified and implemented across your systems, applications, services, processes and other initiatives, including third-party service providers. The DPP prescribes a comprehensive framework for the collection, creation, use, dissemination, maintenance, retention, and/or disclosure of Personal Data / sensitive Personal Data (PD / sPD).
$ 4,235.00 USD
The SEDP Program is designed to support your company’s existing policies and standards. It serves as expert-level guidance that is meant to run a specific capability or function within an organization's cybersecurity department to help communicate user needs and system characteristics to developers, integrators, sponsors, funding decision makers and other stakeholders.
$ 4,235.00 USD
The IAP is focused on pre-production testing and based on established processes used by the US Government (e.g., FISMA, DIACAP, DIARMF) to validate the existence and functionality of controls, prior to a system, application or service going into production. It is not only the right thing to do from a security and privacy perspective, but it is serious job security.
Vulnerability & Patch Management
Vulnerability & Patch Management
Timely vulnerability management and patching reduce your attack surface. Standardize processes with documentation that satisfies auditors and regulators.
$ 2,175.00 USD
The VPMP addresses program-level guidance on HOW to actually manage patching and vulnerability management, including vulnerability scanning and penetration testing. It provides this middle ground between high-level policies and the actual procedures of how systems are patched, systems scanned, etc. on a day-to-day basis by those individual contributors who execute vulnerability management tasks.
$ 2,175.00 USD
The Secure Baseline Configurations (SBC) is a documentation solution to efficiently document what constitutes a "hardened" system in your organization by providing comprehensive hardened baseline configuration documentation to prove that your security is more than just a set of policies and standards. This is applicable to operating systems, applications and services.
Incident Response
Integrated Incident Response
Every organization needs documented incident response. Plans, playbooks, communication templates, and continuity documentation for effective response and recovery.
$ 2,175.00 USD
The IIRP addresses program-level guidance on HOW to actually manage incident response operations, including forensics and reporting. It provides this middle ground between high-level policies and the actual procedures of how Incident Response Plans (IRPs) are executed by those individual contributors task with incident response duties.
$ 4,235.00 USD
The COOP addresses program-level guidance on HOW to actually plan for and respond to both business continuity and disaster recovery (BC/DR) operations. It provides this middle ground between high-level policies and the actual procedures of how BC/DR is executed by those individual contributors task with BC/DR duties.
PCI DSS Compliance
PCI DSS v4 Compliance
Organizations processing, storing, or transmitting cardholder data must comply with PCI DSS. Policies and standards tailored to each Self-Assessment Questionnaire type.
$ 1,155.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,155.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,325.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,625.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,625.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,870.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,870.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
$ 1,325.00 USD
The Cybersecurity & Data Protection Program (CDPP) version for PCI DSS v4.0 contains necessary cybersecurity policies & standards in an editable Microsoft Word format.In addition to the PCI DSS Cybersecurity Policies & Standards, you get additional documentation that will help you implement it and ensure you stay compliant. It is well documented that the lack of standards and lack of employee awareness are the leading causes of security breaches, malware infections (e.g. viruses & spyware), and identity theft.
Program Governance
Additional ComplianceForge Products
This section contains additional ComplianceForge products to assist organizations in achieving program governance.
$ 2,175.00 USD
The Cybersecurity Business Plan (CBP), which some may refer to as a CISO Business Plan, is a business plan template that is specifically tailored for a cybersecurity department that is designed to support an organization's broader technology and business strategies. The CBP is entirely focused at the CISO-level, since it is a department-level planning document.
$ 100.00 USD
ComplianceForge's RASCI matrix provides a practical, role-based accountability model for assigning ownership across all 1,400+ SCF cybersecurity, data privacy, compliance and resilience controls. Built on the NIST NICE Cybersecurity Workforce Framework and expanded with additional roles commonly found in Fortune 1000 organizations, this RASCI is designed to help organizations eliminate ambiguity over “who owns what” in a cybersecurity program.
