- Cybersecurity & data privacy-focused SDLC guidance to implement a program-level governance function.
- Holistic approach to "baking in" NIST 800-160 cybersecurity & data privacy practices.
- Supports evolving requirements for Secure System Development Practices (SSDP).
- Immense time & cost savings - enables subject matter experts to implement SSDP in SDLC processes.
Don't Write It From Scratch.
Regulations like GDPR and CCPA/CPRA expect you to build security and privacy into your systems from the start, not bolt them on later. If an assessor asked how Security by Design and Privacy by Design actually work in your development lifecycle, could you show documented practices, or just good intentions? Most teams know they need this but lack the time and specialized knowledge to write it, leaving a gap that consultants fill expensively. The Secure Engineering & Data Privacy (SEDP) Program gives you a running start: an editable, program-level framework grounded in NIST SP 800-160 for security by design and OASIS for privacy by design, built to embed secure practices across your SDLC. It gets you roughly 80 to 90 percent of the way there, then your team tailors it to your development processes and tooling.
With the European Union General Data Protection Regulation (EU GDPR) effective in 2016 and the California Consumer Privacy Act (CCPA) of 2020, which is now the California Privacy Rights Act (CPRA), companies have an obligation to demonstrate they implement both Security by Design (SbD) and Privacy by Design (PbD). Unfortunately, most businesses lack the knowledge and experience to undertake such documentation efforts. That means businesses are faced to either outsource the work to expensive consultants or they ignore the requirement and hope they do not get in trouble for being non-compliant with this compliance requirement. In either situation, it is not a good place to be. The good news is that ComplianceForge developed a viable cybersecurity and privacy program that is based on NIST 800-160 guidance for security by design and OASIS for privacy by design.
The SEDP is grounded in NIST SP 800-160 for security by design and OASIS for privacy by design. It supports compliance with EU GDPR, CCPA/CPRA, and a wide range of cybersecurity and privacy frameworks that explicitly require organizations to design security and privacy into systems from the start rather than bolting them on afterward.
The SEDP can serve as a foundational element in the organization's combined cybersecurity and privacy program. It can stand alone or be paired with other ComplianceForge products.
What Is The SEDP?
The SEDP Program is designed to support your company’s existing policies and standards. Our solution is focused at the procedural and guideline levels, where it straddles the territory between an organization's centrally-managed policies/standards and its decentralized, stakeholder-executed procedures. The SEDP Program serves as expert-level guidance that is meant to run a specific capability or function within an organization's cybersecurity department to help communicate user needs and system characteristics to developers, integrators, sponsors, funding decision makers and other stakeholders.
This product is intended for cybersecurity, privacy, engineering, and product teams that need to demonstrate Security by Design and Privacy by Design as required by EU GDPR Article 25, CCPA/CPRA, NIST SP 800-160, OASIS PMRM, and similar frameworks. The SEDP also serves as evidence of due care for boards, customers, and regulators who increasingly expect SbD and PbD to be documented and operationalized rather than implicit.
- The SEDP Program is an editable Microsoft Word document that providers program-level guidance to directly supports your company's policies and standards for ensuring secure engineering and privacy principles are operationalized.
- This product addresses the “how?” questions for how your company ensures both security and privacy principles are operationalized.
- It is a reality that most companies have either weak or non-existent guidance on how security or privacy principles are implemented.
- The lack of operationalized security & privacy principles can lead to compliance deficiencies with many statutory, regulatory and contractual obligations.
- NIST 800-160 is the "gold standard" on how to build security into the System Development Life Cycle (SDLC)
- The concept of “secure engineering” is mandatory in numerous statutory, regulatory and contractual requirements.
- The SEDP Program provides a “paint by numbers” approach to ensure your company has evidence of both due care and due diligence for operationalizing security and privacy principles.
- The Integrated Incident Response Plan (IIRP) is based on numerous frameworks, but the core principles are based on NIST 800-160 and the Generally Accepted Privacy Principles (GAPP) which are the de facto standards on security and privacy design principles.
No Software To Install
The SEDP is a one-time purchase of editable Microsoft Word-based documentation templates. There is no software to install, no agent to deploy, no account to provision, and no cloud environment to configure. If the organization can open and edit Microsoft Word files, the SEDP is ready to use.
Microsoft Word
Delivered as fully editable .docx files. Compatible with Word 2016 and newer, Microsoft 365, OpenOffice, LibreOffice, and Google Docs. The SEDP includes built-in styles, tables, and diagrams that are ready for customization.
Email Delivery
Documentation is delivered via email download link within 1-2 business days of purchase, often the same business day. There is no installer, no license server, and no activation step.
One-Time Purchase
A single-entity license is included with purchase. There is no recurring subscription requirement, although an optional update subscription is available to stay current as frameworks and leading practices evolve.
This deployment model is intentional. Secure engineering and privacy program documentation belongs in the organization's own hands, inside its own version control and document management systems, rather than locked inside a vendor's SaaS tool. Once delivered, this product belongs to the buyer.
What Problems Does The SEDP Solve?
Lack of In House Security Experience
Writing cybersecurity & privacy documentation is a skill that most cybersecurity professionals simply are not proficient at and avoid the task at all cost. Tasking your security analysts and engineers to write comprehensive procedure documentation means you are actively taking them away from protecting and defending your network, which is not a wise use of their time. The SEDP Program is an efficient method to obtain comprehensive guidance documentation to implement cybersecurity and privacy principles within your organization!
Compliance Requirements
EU GDPR requires companies that store, process or transmit the personal information of EU citizens to ensure that both cybersecurity and privacy principles are built into processes by default. Can you prove how cybersecurity & privacy principles are implemented?
Audit Failures
Security documentation does not age gracefully like a fine wine. Outdated documentation leads to gaps that expose organizations to audit failures and system compromises. The SEDP Program provide mapping to leading security and privacy frameworks to show you exactly what is required to both stay secure and compliant.
Vendor Requirements
It is very common for clients and partners to request evidence of a security program and this includes policies, standards and procedures. With EU GDPR, vendors and other partners will be expected to demonstrate evidence of compliance with the EU GDPR.
- European Union General Data Protection Regulation (EU GDPR)
- NIST 800-53
- Defense Federal Acquisition Regulations Supplement (DFARS) 252.204-7012 (NIST 800-171)
- Federal Acquisition Regulations (FAR) 52.204-21 - 4
- National Industrial Security Program Operating Manual (NISPOM)
- SOC2
- New York State Department of Financial Service (DFS)
- Payment Card Industry Data Protection Standard (PCI DSS)
- Center for Internet Security Critical Security Controls (CIS CSC)
- Generally Accepted Privacy Principles (GAPP)
How Does The SEDP Solve These Problems?
Clear Documentation
The SEDP Program provides a comprehensive approach to operationalizing both cybersecurity and privacy principles. This equates to a time saving of hundreds of hours and tens of thousands of dollars in staff and consultant expenses!
Time Savings
The SEDP Program can provide your organization with a templated solution that requires minimal resources to fine tune for your organization's specific cybersecurity and privacy needs.
Alignment With Leading Practices
The SEDP Program is written to support leading cybersecurity and privacy frameworks!
The SEDP Program can serve as a foundational element in your organization's privacy program. It can stand alone or be paired with other specialized products we offer.
Cybersecurity and privacy do not need to be hard. The Secure Engineering & Data Privacy (SEDP Program) document is meant to simplify how security and privacy can be operationalized in a “paint by numbers” approach. This product is comprised of editable Microsoft Word and Excel documentation so you can customize it for your specific needs.
What Is Included?
Our products are one-time purchases with no software to install - you are buying Microsoft Office-based documentation templates that you can edit for your specific needs. If you can use Microsoft Office or OpenOffice, you can use this product! The SEDP Program comes in both editable Microsoft Word and Excel formats. The SEDP Program is capable of scaling for any sized company.
The SEDP Program is an editable Microsoft Word document that providers program-level guidance to directly supports your company's policies and standards for ensuring secure engineering and privacy principles are operationalized.
The SEDP Program Excel checklists provide a wealth of experience to bake in security and privacy principles by establishing methodical and repeatable processes.
- Logically-organized phases
- Task focus (How tasks support the lifecycle phases)
- Task #
- Activity Description
- Reasonable Task Deliverables
- Mapping to leading practices:
- NIST 800-160 R1
- NIST 800-53
- ISO 27002
- OASIS PMRM
- Level of Effort (expectation for basics or enhanced requirements)
- Stakeholder RACI Matrix (Responsible, Accountable, Consulted, Informed)
Cost Savings Estimate
When you look at the costs associated with either (1) hiring an external consultant to write cybersecurity documentation for you or (2) tasking your internal staff to write it, the cost comparisons paint a clear picture that buying from ComplianceForge is the logical option. Compared to hiring a consultant, you can save months of wait time and tens of thousands of dollars. Whereas, compared to writing your own documentation, you can potentially save hundreds of work hours and the associated cost of lost productivity. Purchasing the SEDP from ComplianceForge offers these fundamental advantages when compared to the other options for obtaining quality cybersecurity documentation:
Internal Staff Cost
For your internal staff to generate comparable documentation, it would take them an estimated 310 internal staff work hours, which equates to a cost of approximately $23,500 in staff-related expenses. This is about 4 to 6 months of development time where your senior cybersecurity and privacy staff would be diverted from operational duties.
The SEDP is approximately 15% of the cost for your internal staff to generate equivalent documentation.
External Consultant Cost
If you hire a consultant to generate this documentation, it would take them an estimated 200 consultant work hours, which equates to a cost of approximately $60,500. This is about 2 to 3 months of development time for a contractor to provide you with the deliverable.
The SEDP is approximately 7% of the cost for an external consultant to generate equivalent documentation.
Product Examples
The SEDP Program addresses program-level guidance on HOW to actually manage cybersecurity and privacy principles, so that secure processes are designed and implemented by default. Policies & standards are absolutely necessary to an organization, but they fail to describe HOW privacy and security principles are actually planned and managed. The SEDP Program provides this middle ground between high-level policies and the actual procedures of how developers, PMs, system integrators and system admins do their jobs to design, implement and maintain technology solutions.
Coverage spans the strategic, operational, and tactical components of secure engineering and privacy, regardless of whether the organization's primary framework is NIST, ISO, SCF, or another framework.
Below is a PDF example containing a sample of the policies & standards you would receive upon purchasing the SEDP.
Below is a PDF example containing a sample of the checklists you would receive upon purchasing the SEDP.
How Much Customization Remains?
Given the difficult nature of writing templated secure engineering and privacy documentation, ComplianceForge aims for approximately an 80% solution because it is impossible to write a 100% cookie-cutter document that can be equally applied across every organization. SbD and PbD depend on the specific SDLC, the technology stack, the data inventory, and the regulatory environment, so the remaining work is fine-tuning the SEDP with the specific information that only the organization knows.
In practice, customization is filling in the blanks and following the guidance provided to identify the who, what, when, where, why, and how for the specific organization. Typical customization tasks include adding the company name and logo, naming actual role owners (engineering leads, privacy officers, architects), tailoring the SbD/PbD review gates to the existing SDLC, calibrating data inventory references to the actual personal data landscape, and integrating the SEDP with project management and change management workflows already in place.
Professional Services
ComplianceForge offers optional professional services to customize purchased documentation. Professional services are not required to customize ComplianceForge documentation. However, some clients want our subject matter expertise to help customize their documentation to meet their specific business needs. If you have any questions about our professional services, please contact us at:
We offer the following professional service bundles:
5-Hour Bundle
This includes five (5) hours of professional services, which may be beneficial for companies that need some guidance on getting started with how to tailor their documentation.
10-Hour Bundle
This includes ten (10) hours of professional services, which may be beneficial for companies that need additional guidance on tailoring their documentation to meet their compliance requirements.
20-Hour Bundle
This includes twenty (20) hours of professional services, which may be beneficial for companies that need robust services, beyond just 10 hours, to assist in tailoring their documentation to meet their compliance requirements.
Purchased professional service hours expire 120 days (4 months) from the time of purchase if unused. Hours are intended to supplement, not replace, your own customization work, since only your organization knows the exact details to tailor your documentation. For questions regarding scoping a professional services engagement or configuring a custom package, contact ComplianceForge directly through the Contact Us page.
Reducing Risk Through Cybersecurity For Privacy by Design (C4P)
The Secure Engineering & Data Privacy (SEDP) document supports your company’s existing policies and standards. Our solution is focused at the procedural and guideline levels. The SEDP Program document is focused on understanding risk associated with cybersecurity and privacy so that risk can be:
- Reduced;
- Avoided;
- Transferred; or
- Accepted.
Implementing both Security by Design (SbD) and Privacy by Design (PbD) principles is a systematic way to find and address weaknesses, flaws and risks to your company.
- Repeatable, methodical processes that seek out both security and privacy risk reduces the chance of surprises.
- Addressing security issues in an orderly manner gives your company a better assurance that gaps have been closed properly and as quickly as possible.
Leverage Common Touch Points Between Cybersecurity & Privacy
Systems security engineering delivers systems deemed adequately secure by stakeholders. The fundamental relationships among assets, an asset-dependent interpretation of loss, and the corresponding loss consequences are central to any discussion of system security.
This is where aligning your company’s Security by Design (SbD) efforts with the Risk Management Framework (RMF) (e.g., NIST 800-37) can be very beneficial, since the RMF provides a well-established format to securely engineer and maintain systems throughout the entire life cycle of the asset. Utilizing common linkages, Privacy by Design (PbD) is incorporated into the RMF cycle.
The graphic to the right illustrates the Risk Management Framework's Secure Life Cycle, highlighting the integration of Security by Design (SbD) and Privacy by Design (PbD) principles. This framework ensures that security and privacy are embedded throughout the system's development and operational phases, providing a comprehensive approach to managing risks and safeguarding assets.
Cybersecurity & Privacy Requirements
What we've done is take on the heavy lifting to integrate security and privacy controls into standard project management processes. This allows your teams to have a "paint by numbers" approach to demonstrating that both cybersecurity and privacy principles are baked into the process! We identified the stages where both cybersecurity and privacy requirements are expected as part of project development. This can enable your teams to work more effectively together and reduce the negative effect of teams working in silos.
All too often, when projects are commenced, involvement from key stakeholders is siloed, as compared to operating as a cohesive team. We want to help your company avoid the following security & privacy pitfalls where:
- Project / application teams work in a vacuum, unaware of security or privacy concerns;
- Privacy and security conduct their own assessments without any information sharing or collaboration; and
- Security involvement is viewed as a final hurdle to overcome, just prior to “go live” for the project.
Understanding Privacy & Security Starts With Defining Requirements
Understanding the requirements for both Security by Design (SbD) and Privacy by Design (PbD) principles involves a simple process of distilling expectations. This process is all part of documenting reasonable expectations to right-size the approach, since every organization is unique:
- Applicable best practices based on your company’s industry.
- ISO 27002
- NIST 800-53
- SOC II
- Operational Technology (OT) & Internet of Things (IoT)
- Statutory obligations (e.g., state, federal and international laws)
- FTC Act (prohibition on unfair business practices)
- Family Educational Rights and Privacy Act (FERPA)
- Children's Online Privacy Protection Act (COPPA)
- State ID theft laws (e.g., MA 201 CMR 17)
- Regulatory obligations (e.g., regulatory bodies or governmental agencies)
- EU General Data Protection Regulation (EU GDPR)
- NY Department of Financial Services (23 NYCRR 500)
- FISMA / DIACAP / DIARMF
- Contractual obligations (e.g., vendor agreements)
- DFARS / FAR (e.g., NIST 800-171)
- Privacy Shield
- PCI DSS
Operationalizing Security by Design (SbD)
Security by Design (SbD) requirements come from numerous sources. In this context, the most important are:
- International Organization for Standardization (ISO)
- National Institute for Standards & Technology (NIST)
- US Government (HIPAA & FedRAMP)
- Information Systems Audit and Control Association (ISACA)
- Cloud Security Alliance (CSA)
- Center for Internet Security (CIS)
- Open Web Application Security Project (OWASP)
Operationalizing Privacy by Design (PbD)
Privacy by Design (PbD) requirements come from numerous sources. In this context, the most important are:
- Fair Information Practice Principles (FIPPs)
- European Union (EU) General Data Protection Regulation (GDPR)
- Organization for the Advancement of Structured Information Standards (OASIS)
- International Organization for Standardization (ISO)
- National Institute for Standards & Technology (NIST)
- Information Systems Audit and Control Association (ISACA)
- US Government (HIPAA & FTC Act)
Data-Centric Security (DCS) = Defense-In-Depth Approach To Security
Thinking in terms of data, or information, it is your company’s most valuable asset. Therefore, being "data-centric" is how we approach our defense-in-depth concept. When you look at the diagram below, if you envision data protection as a set of concentric rings, at the center of the protection is your data.
